ByteOS

Product

MySQL Server

Versions

Affected

5.6.49 and prior
5.7.31 and prior
8.0.21 and prior

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0003/	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/	vendor-advisory x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/	vendor-advisory x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html	mailing-list x_refsource_MLIST
https://security.gentoo.org/glsa/202105-27	vendor-advisory x_refsource_GENTOO

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Resource:

x_refsource_MISC

Hyperlink: https://security.netapp.com/advisory/ntap-20201023-0003/

Resource:

x_refsource_CONFIRM

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/

Resource:

vendor-advisory

x_refsource_FEDORA

Hyperlink: https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://security.gentoo.org/glsa/202105-27

Resource:

vendor-advisory

x_refsource_GENTOO

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC x_transferred
https://security.netapp.com/advisory/ntap-20201023-0003/	x_refsource_CONFIRM x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/	vendor-advisory x_refsource_FEDORA x_transferred
https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html	mailing-list x_refsource_MLIST x_transferred
https://security.gentoo.org/glsa/202105-27	vendor-advisory x_refsource_GENTOO x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20201023-0003/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/

Resource:

vendor-advisory

x_refsource_FEDORA

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202105-27

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:21 Oct, 2020 | 15:15

Updated At:07 Nov, 2023 | 03:17

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:L/Au:S/C:N/I:N/A:C

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:N/I:N/A:C

CPE Matches

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

>>mysql>>Versions from 5.6.0(inclusive) to 5.6.49(inclusive)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

>>mysql>>Versions from 5.7.0(inclusive) to 5.7.31(inclusive)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

>>mysql>>Versions from 8.0.0(inclusive) to 8.0.21(inclusive)

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*

>>active_iq_unified_manager>>Versions from 7.3(inclusive)

cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*

>>active_iq_unified_manager>>Versions from 9.5(inclusive)

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

>>oncommand_insight>>-

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

>>oncommand_workflow_automation>>-

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

>>snapcenter>>-

Debian GNU/Linux

>>debian_linux>>9.0

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Fedora Project

>>fedora>>31

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Fedora Project

>>fedora>>32

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Fedora Project

>>fedora>>33

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

>>mariadb>>Versions from 10.1.0(inclusive) to 10.1.48(exclusive)

>>mariadb>>Versions from 10.2.0(inclusive) to 10.2.35(exclusive)

>>mariadb>>Versions from 10.3.0(inclusive) to 10.3.26(exclusive)

>>mariadb>>Versions from 10.4.0(inclusive) to 10.4.16(exclusive)

>>mariadb>>Versions from 10.5.0(inclusive) to 10.5.7(exclusive)

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html	secalert_us@oracle.com	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/	secalert_us@oracle.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/	secalert_us@oracle.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/	secalert_us@oracle.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/	secalert_us@oracle.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/	secalert_us@oracle.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/	secalert_us@oracle.com	N/A
https://security.gentoo.org/glsa/202105-27	secalert_us@oracle.com	Third Party Advisory
https://security.netapp.com/advisory/ntap-20201023-0003/	secalert_us@oracle.com	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	secalert_us@oracle.com	Vendor Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2021/01/msg00027.html

Source: secalert_us@oracle.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZU3PA5XJXNQ4C4F6435ARM6WKM3OZYR/

Source: secalert_us@oracle.com

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZZ3XIRPFPAWBZLYBN777ANXSFXAPPB/

Source: secalert_us@oracle.com

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7RVY2Z7HYQHFJXBGARXUAGKUDAWYPP4/

Source: secalert_us@oracle.com

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPW5YMZR5C7D7NBZQSTDOB3XAI5QP32Y/

Source: secalert_us@oracle.com

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/

Source: secalert_us@oracle.com

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVS6KNVBZCLZBKNJ5JA2PGAG3NTOJVH6/

Source: secalert_us@oracle.com

Resource: N/A

Hyperlink: https://security.gentoo.org/glsa/202105-27

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20201023-0003/

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert_us@oracle.com

Resource:

Vendor Advisory

Similar CVEs

369Records found

CVE-2024-20961

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.47% / 64.66%

7 Day CHG~0.00%

Published-16 Jan, 2024 | 21:41

Updated-20 Jun, 2025 | 18:15

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Vendor-Oracle Corporation NetApp, Inc.

Product-mysql oncommand_insight MySQL Server

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2024-20975

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 53.88%

7 Day CHG~0.00%

Published-16 Jan, 2024 | 21:41

Updated-02 Jun, 2025 | 15:07

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Vendor-Oracle Corporation NetApp, Inc.

Product-mysql oncommand_insight MySQL Server

CVE-2024-21196

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 58.40%

7 Day CHG+0.12%

Published-15 Oct, 2024 | 19:52

Updated-03 Nov, 2025 | 22:16

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Product-mysql MySQL Server

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2024-20962

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 55.46%

7 Day CHG~0.00%

Published-17 Feb, 2024 | 01:50

Updated-04 Nov, 2025 | 19:16

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2024-20973

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.21% / 43.07%

7 Day CHG~0.00%

Published-16 Jan, 2024 | 21:41

Updated-09 Jun, 2025 | 20:36

Vendor-Oracle Corporation NetApp, Inc.

Product-mysql oncommand_insight MySQL Server

CVE-2024-21177

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.42% / 62.13%

7 Day CHG~0.00%

Published-16 Jul, 2024 | 22:40

Updated-04 Nov, 2025 | 17:15

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Product-mysql_server mysql_cluster MySQL NDB Cluster MySQL Server

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2021-2012

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.9||MEDIUM

EPSS-0.34% / 56.76%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:42

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vendor-NetApp, Inc.Oracle Corporation Fedora Project

Product-oncommand_insight fedora oncommand_workflow_automation mysql snapcenter MySQL Server

CVE-2018-16841

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-5.7||MEDIUM

EPSS-7.11% / 91.59%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 14:00

Updated-05 Aug, 2024 | 10:32

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.

Vendor-[UNKNOWN]Canonical Ltd.Debian GNU/Linux Samba

Product-ubuntu_linux debian_linux samba samba

CWE ID-CWE-416

Use After Free

CWE ID-CWE-415

Double Free

CVE-2024-21230

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.28% / 51.15%

7 Day CHG-0.09%

Published-15 Oct, 2024 | 19:52

Updated-03 Nov, 2025 | 22:16

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Product-mysql MySQL Cluster MySQL Server

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2015-5745

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-1.40% / 80.55%

7 Day CHG~0.00%

Published-23 Jan, 2020 | 19:35

Updated-06 Aug, 2024 | 06:59

Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.

Vendor-Fedora Project QEMU Arista Networks, Inc.

Product-fedora qemu eos QEMU

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2018-16846

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-4.60% / 89.31%

7 Day CHG~0.00%

Published-15 Jan, 2019 | 18:00

Updated-05 Aug, 2024 | 10:32

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.

Vendor-[UNKNOWN]Canonical Ltd.Red Hat, Inc.openSUSE Debian GNU/Linux

Product-ceph_storage ubuntu_linux enterprise_linux_server debian_linux ceph leap ceph

CWE ID-CWE-770

Allocation of Resources Without Limits or Throttling

CVE-2024-21171

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.28% / 51.15%

7 Day CHG~0.00%

Published-16 Jul, 2024 | 22:40

Updated-04 Nov, 2025 | 17:15

Product-mysql MySQL Server

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2024-20960

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.28% / 51.15%

7 Day CHG~0.00%

Published-17 Feb, 2024 | 01:50

Updated-04 Nov, 2025 | 19:16

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVE-2018-16851

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-9.20% / 92.74%

7 Day CHG~0.00%

Published-28 Nov, 2018 | 14:00

Updated-05 Aug, 2024 | 10:32

Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service.

Vendor-[UNKNOWN]Canonical Ltd.Debian GNU/Linux Samba

Product-ubuntu_linux debian_linux samba samba

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2021-2001

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.9||MEDIUM

EPSS-0.36% / 58.28%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:44

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.50 and prior, 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vendor-NetApp, Inc.Oracle Corporation Fedora Project

Product-oncommand_insight fedora oncommand_workflow_automation mysql snapcenter MySQL Server

CVE-2021-2030

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.9||MEDIUM

EPSS-0.20% / 41.97%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:38

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vendor-NetApp, Inc.Oracle Corporation

Product-oncommand_insight mysql oncommand_workflow_automation snapcenter MySQL Server

CVE-2015-5694

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.89% / 75.68%

7 Day CHG~0.00%

Published-22 Nov, 2019 | 14:13

Updated-06 Aug, 2024 | 06:59

Designate does not enforce the DNS protocol limit concerning record set sizes

Vendor-n/a Debian GNU/Linux OpenStack Red Hat, Inc.

Product-designate debian_linux enterprise_linux_openstack_platform n/a

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2018-14661

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-2.57% / 85.63%

7 Day CHG~0.00%

Published-31 Oct, 2018 | 20:00

Updated-05 Aug, 2024 | 09:38

It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service.

Vendor-gluster The Gluster Project Debian GNU/Linux Red Hat, Inc.

Product-enterprise_linux_server debian_linux virtualization enterprise_linux virtualization_host glusterfs glusterfs-server

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-134

Use of Externally-Controlled Format String

CVE-2018-14659

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-2.14% / 84.34%

7 Day CHG~0.00%

Published-31 Oct, 2018 | 19:00

Updated-05 Aug, 2024 | 09:38

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory.

Vendor-The Gluster Project Debian GNU/Linux Red Hat, Inc.

Product-enterprise_linux_server virtualization debian_linux enterprise_linux virtualization_host gluster_file_system glusterfs

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2026-34271

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 11.94%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:06

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2018-14652

Matching Score-8

Assigner-Red Hat, Inc.

Product-enterprise_linux_server debian_linux enterprise_linux_virtualization gluster_storage enterprise_virtualization_host glusterfs

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-2.30% / 84.84%

7 Day CHG~0.00%

Published-31 Oct, 2018 | 19:00

Updated-05 Aug, 2024 | 09:38

The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.

Vendor-The Gluster Project Debian GNU/Linux Red Hat, Inc.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2018-14660

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-1.60% / 81.83%

7 Day CHG~0.00%

Published-01 Nov, 2018 | 14:00

Updated-05 Aug, 2024 | 09:38

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.

Vendor-gluster [UNKNOWN]Debian GNU/Linux Red Hat, Inc.

Product-enterprise_linux_server debian_linux virtualization enterprise_linux virtualization_host glusterfs glusterfs

CWE ID-CWE-400

Uncontrolled Resource Consumption

CWE ID-CWE-770

Allocation of Resources Without Limits or Throttling

CVE-2023-6536

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.03% / 10.03%

7 Day CHG~0.00%

Published-07 Feb, 2024 | 21:05

Updated-06 Nov, 2025 | 21:45

Kernel: null pointer dereference in __nvmet_req_complete

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

Vendor-Linux Kernel Organization, Inc Red Hat, Inc.Debian GNU/Linux

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2023-6356

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.02% / 6.42%

7 Day CHG~0.00%

Published-07 Feb, 2024 | 21:04

Updated-06 Nov, 2025 | 21:45

Kernel: null pointer dereference in nvmet_tcp_build_iovec

Vendor-Linux Kernel Organization, Inc Red Hat, Inc.Debian GNU/Linux

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2026-34308

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 11.94%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:10

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2026-34270

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 11.94%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:06

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2026-34272

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 11.94%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:06

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2026-34276

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 11.94%

7 Day CHG~0.00%

Published-21 Apr, 2026 | 20:35

Updated-23 Apr, 2026 | 15:05

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2023-47158

Matching Score-8

Assigner-IBM Corporation

Vendor-Oracle Corporation IBM Corporation HP Inc.Linux Kernel Organization, Inc Microsoft Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.06% / 19.63%

7 Day CHG~0.00%

Published-22 Jan, 2024 | 20:05

Updated-30 May, 2025 | 14:21

IBM Db2 denial of service

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270750.

Product-solaris linux_kernel db2 hp-ux linux_on_ibm_z windows aix Db2 for Linux, UNIX and Windows

CWE ID-CWE-20

Improper Input Validation

CVE-2025-30682

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.27% / 50.21%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:30

Updated-03 Nov, 2025 | 20:18

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2025-30687

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.27% / 50.21%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-03 Nov, 2025 | 20:18

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2025-30688

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.27% / 50.21%

7 Day CHG~0.00%

Published-15 Apr, 2025 | 20:31

Updated-03 Nov, 2025 | 20:18

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2025-30753

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-0.09% / 25.77%

7 Day CHG~0.00%

Published-15 Jul, 2025 | 19:27

Updated-16 Jul, 2025 | 16:15

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Product-Oracle WebLogic Server

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2023-42670

Matching Score-8

Assigner-Red Hat, Inc.

Product-fedora samba Red Hat Enterprise Linux 9 Red Hat Storage 3 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 8

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.39% / 59.79%

7 Day CHG~0.00%

Published-03 Nov, 2023 | 07:58

Updated-20 Nov, 2025 | 18:28

Samba: ad dc busy rpc multiple listener dos

A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.

Vendor-Red Hat, Inc.Fedora Project Samba

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2018-1257

Matching Score-8

Assigner-Dell

Product-communications_diameter_signaling_router insurance_rules_palette enterprise_manager_for_mysql_database tape_library_acsls openshift retail_customer_insights primavera_gateway flexcube_private_banking endeca_information_discovery_integrator utilities_network_management_system healthcare_master_person_index communications_performance_intelligence_center spring_framework service_architecture_leveraging_tuxedo weblogic_server application_testing_suite health_sciences_information_manager retail_order_broker communications_converged_application_server goldengate_for_big_data big_data_discovery hospitality_guest_access insurance_calculation_engine retail_open_commerce_platform communications_unified_inventory_management enterprise_manager_ops_center communications_services_gatekeeper enterprise_manager_base_platform retail_predictive_application_server agile_product_lifecycle_management Spring Framework

Matching Score-8

Assigner-Dell

CVSS Score-6.5||MEDIUM

EPSS-1.18% / 78.84%

7 Day CHG~0.00%

Published-11 May, 2018 | 20:00

Updated-16 Sep, 2024 | 22:56

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Vendor-Oracle Corporation VMware (Broadcom Inc.)Red Hat, Inc.

CVE-2018-10914

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-5.5||MEDIUM

EPSS-4.33% / 88.98%

7 Day CHG~0.00%

Published-04 Sep, 2018 | 14:00

Updated-05 Aug, 2024 | 07:54

It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.

Vendor-gluster Debian GNU/Linux Red Hat, Inc.openSUSE

Product-enterprise_linux_server debian_linux virtualization_host glusterfs leap glusterfs

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2018-11056

Matching Score-8

Assigner-Dell

Product-timesten_in-memory_database bsafe_crypto-c communications_ip_service_activator core_rdbms communications_analytics bsafe goldengate_application_adapters real_user_experience_insight application_testing_suite jd_edwards_enterpriseone_tools retail_predictive_application_server enterprise_manager_ops_center security_service BSAFE Crypto-C Micro Edition BSAFE Micro Edition Suite

Matching Score-8

Assigner-Dell

CVSS Score-6.5||MEDIUM

EPSS-1.96% / 83.63%

7 Day CHG~0.00%

Published-31 Aug, 2018 | 18:00

Updated-05 Aug, 2024 | 07:54

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, potentially causing a Denial Of Service.

Vendor-Dell Inc.RSA Security LLC Oracle Corporation

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2023-36054

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.65% / 70.90%

7 Day CHG~0.00%

Published-07 Aug, 2023 | 00:00

Updated-11 Oct, 2024 | 13:57

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

Vendor-n/a Debian GNU/Linux MIT (Massachusetts Institute of Technology)NetApp, Inc.

Product-clustered_data_ontap ontap_tools debian_linux active_iq_unified_manager hci kerberos_5 management_services_for_element_software n/a

CWE ID-CWE-824

Access of Uninitialized Pointer

CVE-2018-1000026

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.7||HIGH

EPSS-0.86% / 75.23%

7 Day CHG~0.00%

Published-09 Feb, 2018 | 23:00

Updated-05 Aug, 2024 | 12:33

Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..

Vendor-n/a Linux Kernel Organization, Inc Debian GNU/Linux Canonical Ltd.Red Hat, Inc.

Product-enterprise_linux_server ubuntu_linux debian_linux linux_kernel enterprise_linux_workstation enterprise_linux enterprise_linux_desktop n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2020-14888

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.9||MEDIUM

EPSS-0.20% / 41.97%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-26 Sep, 2024 | 20:04

Product-mysql MySQL Server

CVE-2021-2014

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.9||MEDIUM

EPSS-0.20% / 41.97%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:42

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vendor-NetApp, Inc.Oracle Corporation

Product-oncommand_insight mysql oncommand_workflow_automation snapcenter MySQL Server

CVE-2017-9461

Matching Score-8

Assigner-MITRE Corporation

Product-enterprise_linux_desktop enterprise_linux_server_tus enterprise_linux_workstation enterprise_linux_server_eus samba enterprise_linux_server debian_linux enterprise_linux_server_aus n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-3.38% / 87.46%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

Vendor-n/a Samba Debian GNU/Linux Red Hat, Inc.

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2016-0502

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.5||MEDIUM

EPSS-1.46% / 80.97%

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

Vendor-n/a MariaDB Foundation openSUSE Oracle Corporation

Product-leap mariadb mysql opensuse n/a

CVE-2023-29530

Matching Score-8

Assigner-GitHub, Inc.

Matching Score-8

Assigner-GitHub, Inc.

CVSS Score-7.5||HIGH

EPSS-0.67% / 71.47%

7 Day CHG+0.13%

Published-24 Apr, 2023 | 19:34

Updated-13 Feb, 2025 | 16:49

Laminas Diactoros vulnerable to HTTP Multiline Header Termination

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.

Vendor-guzzlephp getlaminas laminas Fedora Project

Product-fedora laminas-diactoros psr-7 laminas-diactoros

CWE ID-CWE-20

Improper Input Validation

CVE-2015-5278

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-1.76% / 82.73%

7 Day CHG~0.00%

Published-23 Jan, 2020 | 19:40

Updated-06 Aug, 2024 | 06:41

The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

Vendor-Canonical Ltd.QEMU Fedora Project Arista Networks, Inc.

Product-ubuntu_linux fedora qemu eos QEMU

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2016-0504

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-6.8||MEDIUM

EPSS-1.85% / 83.10%

7 Day CHG~0.00%

Published-21 Jan, 2016 | 02:00

Updated-06 May, 2026 | 22:30

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503.

Vendor-n/a Canonical Ltd.openSUSE Oracle Corporation Red Hat, Inc.

Product-ubuntu_linux mysql opensuse leap enterprise_linux n/a

CVE-2021-2031

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-4.9||MEDIUM

EPSS-0.34% / 56.76%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:38

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vendor-NetApp, Inc.Oracle Corporation

Product-oncommand_insight mysql oncommand_workflow_automation snapcenter MySQL Server

CVE-2015-5239

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-8.41% / 92.36%

7 Day CHG~0.00%

Published-23 Jan, 2020 | 19:52

Updated-06 Aug, 2024 | 06:41

Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.

Vendor-Canonical Ltd.SUSE QEMU Arista Networks, Inc.Fedora Project

Product-ubuntu_linux linux_enterprise_software_development_kit linux_enterprise_server qemu fedora linux_enterprise_debuginfo linux_enterprise_desktop eos QEMU

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2015-5292

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.8||MEDIUM

EPSS-2.69% / 85.95%

7 Day CHG~0.00%

Published-29 Oct, 2015 | 16:00

Updated-06 May, 2026 | 22:30

Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.

Vendor-n/a Fedora Project

Product-sssd n/a

CVE-2015-2927

Matching Score-8

Assigner-MITRE Corporation