Press CTR-C to copy XML [help]

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

### How to read the report | Suppressing false positives | Getting Help: google group | github issues

## Project: DependencyCheck

Scan Information (show all):

- dependency-check version: 1.4.4-SNAPSHOT
- Report Generated On: Oct 9, 2016 at 07:04:35 EDT
- Dependencies Scanned: 306 (289 unique)
- Vulnerable Dependencies: 36
- Vulnerabilities Found: 289
- Vulnerabilities Suppressed: 0
- ...
- NVD CVE 2002: 01/06/2014 07:15:27
- NVD CVE 2003: 01/06/2014 06:51:06
- NVD CVE 2004: 01/06/2014 06:45:45
- NVD CVE 2005: 01/06/2014 06:35:57
- NVD CVE 2006: 01/06/2014 06:19:14
- NVD CVE 2007: 01/06/2014 05:53:34
- NVD CVE 2008: 01/06/2014 05:28:59
- NVD CVE 2009: 01/06/2014 05:01:49
- NVD CVE 2010: 01/06/2014 04:41:37
- NVD CVE 2011: 01/06/2014 04:18:07
- NVD CVE 2012: 01/06/2014 03:57:32
- NVD CVE 2013: 01/06/2014 03:33:47
- NVD CVE 2014: 07/10/2016 03:59:32
- NVD CVE 2015: 08/10/2016 03:39:54
- NVD CVE 2016: 08/10/2016 03:16:25
- NVD CVE Checked: 09/10/2016 07:04:06
- NVD CVE Modified: 09/10/2016 06:04:43
- NVD CVE test: 31/12/1969 19:00:01
- VersionCheckOn: 1476011025345

Display: Showing Vulnerable Dependencies (click to show all)

Dependency | CPE | GAV | Highest Severity | CVE Count | CPE Confidence | Evidence Count
--- | --- | --- | --- | --- | --- | ---
activation-1.1.jar |  | javax.activation:activation:1.1 |  | 0 |  | 19
annogen-0.1.0.jar |  | annogen:annogen:0.1.0 |  | 0 |  | 11
annotations-3.0.1u2.jar |  | com.google.code.findbugs:annotations:3.0.1u2 |  | 0 |  | 18
ant-1.9.7.jar |  | org.apache.ant:ant:1.9.7 |  | 0 |  | 19
aopalliance-1.0.jar |  | aopalliance:aopalliance:1.0 |  | 0 |  | 13
aspectjrt-1.6.5.jar |  | org.aspectj:aspectjrt:1.6.5 |  | 0 |  | 18
aspectjweaver-1.6.5.jar |  | org.aspectj:aspectjweaver:1.6.5 |  | 0 |  | 19
binutils/configure |  |  |  | 0 |  | 4
binutils/configure.ac |  |  |  | 0 |  | 3
ghostscript/configure.ac | cpe:/a:ghostscript:ghostscript:8.62 |  | High | 5 | HIGHEST | 4
readable-code/configure |  |  |  | 0 |  | 6
readable-code/configure.ac |  |  |  | 0 |  | 6
axiom-api-1.2.7.jar |  | org.apache.ws.commons.axiom:axiom-api:1.2.7 |  | 0 |  | 16
axiom-dom-1.2.7.jar |  | org.apache.ws.commons.axiom:axiom-dom:1.2.7 |  | 0 |  | 16
axiom-impl-1.2.7.jar |  | org.apache.ws.commons.axiom:axiom-impl:1.2.7 |  | 0 |  | 16
axis-1.4.jar | cpe:/a:apache:axis:1.4 | axis:axis:1.4 | Medium | 2 | HIGHEST | 17
axis2-kernel-1.4.1.jar | cpe:/a:apache:axis2:1.4.1 | org.apache.axis2:axis2-kernel:1.4.1 | High | 6 | HIGHEST | 16
backport-util-concurrent-3.1.jar |  | backport-util-concurrent:backport-util-concurrent:3.1 |  | 0 |  | 16
bootable-0.1.0.jar |  | org.owasp.testing:bootable:0.1.0 |  | 0 |  | 9
bootable-0.1.0.jar: lib-0.1.0.jar |  | org.owasp.testing:lib:0.1.0 |  | 0 |  | 10
ffmpeg\ffmpeg_version.cmake | cpe:/a:ffmpeg:ffmpeg:55.18.102 |  | High | 3 | LOW | 3
cmake\cl2cpp.cmake |  |  |  | 0 |  | 2
cmake\copyAndroidLibs.cmake |  |  |  | 0 |  | 1
cmake\FindCUDA.cmake |  |  |  | 0 |  | 1
FindCUDA\make2cmake.cmake |  |  |  | 0 |  | 2
FindCUDA\parse_cubin.cmake |  |  |  | 0 |  | 1
FindCUDA\run_nvcc.cmake |  |  |  | 0 |  | 1
cmake\OpenCVCompilerOptions.cmake |  |  |  | 0 |  | 1
cmake\OpenCVConfig.cmake |  |  |  | 0 |  | 1
cmake\OpenCVCRTLinkage.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectAndroidSDK.cmake | cpe:/a:android:android_sdk:- |  |  | 0 | LOW | 1
cmake\OpenCVDetectApacheAnt.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectCStripes.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectCUDA.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectCXXCompiler.cmake |  |  |  | 0 |  | 3
cmake\OpenCVDetectDirectX.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectOpenCL.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectPython.cmake | cpe:/a:python:python:- |  | High | 11 | LOW | 1
cmake\OpenCVDetectTBB.cmake |  |  |  | 0 |  | 1
cmake\OpenCVDetectVTK.cmake |  |  |  | 0 |  | 1
cmake\OpenCVExtraTargets.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindIntelPerCSDK.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindIPP.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindIPPAsync.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindLATEX.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindLibsGrfmt.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindLibsGUI.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindLibsPerf.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindLibsVideo.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindMatlab.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindOpenEXR.cmake | cpe:/a:openexr:openexr:- |  |  | 0 | LOW | 1
cmake\OpenCVFindOpenNI.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindOpenNI2.cmake |  |  |  | 0 |  | 2
cmake\OpenCVFindWebP.cmake |  |  |  | 0 |  | 1
cmake\OpenCVFindXimea.cmake |  |  |  | 0 |  | 1
cmake\OpenCVGenABI.cmake |  |  |  | 0 |  | 1
cmake\OpenCVGenAndroidMK.cmake |  |  |  | 0 |  | 1
cmake\OpenCVGenConfig.cmake |  |  |  | 0 |  | 1
cmake\OpenCVGenHeaders.cmake |  |  |  | 0 |  | 1
cmake\OpenCVGenInfoPlist.cmake |  |  |  | 0 |  | 1
cmake\OpenCVGenPkgconfig.cmake |  |  |  | 0 |  | 1
cmake\OpenCVMinDepVersions.cmake |  |  |  | 0 |  | 1
cmake\OpenCVModule.cmake |  |  |  | 0 |  | 1
cmake\OpenCVPackaging.cmake |  |  |  | 0 |  | 1
cmake\OpenCVPCHSupport.cmake |  |  |  | 0 |  | 1
cmake\OpenCVUtils.cmake |  |  |  | 0 |  | 1
cmake\OpenCVVersion.cmake |  |  |  | 0 |  | 1
opencv\CMakeLists.txt |  |  |  | 0 |  | 2
zlib\CMakeLists.txt |  |  |  | 0 |  | 2
commons-cli-1.2.jar |  | commons-cli:commons-cli:1.2 |  | 0 |  | 25
commons-codec-1.2.jar |  | commons-codec:commons-codec:1.2 |  | 0 |  | 20
commons-collections-3.2.2.jar | cpe:/a:apache:commons_collections:3.2.2 | commons-collections:commons-collections:3.2.2 |  | 0 | LOW | 28
commons-compress-1.12.jar | cpe:/a:apache:commons-compress:1.12 | org.apache.commons:commons-compress:1.12 |  | 0 | LOW | 29
commons-fileupload-1.2.1.jar | cpe:/a:apache:commons_fileupload:1.2.1 | commons-fileupload:commons-fileupload:1.2.1 | High | 3 | HIGHEST | 23
commons-httpclient-3.1.jar | cpe:/a:apache:commons-httpclient:3.1 cpe:/a:apache:httpclient:3.1 | commons-httpclient:commons-httpclient:3.1 | Medium | 2 | LOW | 20
commons-io-2.5.jar |  | commons-io:commons-io:2.5 |  | 0 |  | 28
commons-lang-2.4.jar |  | commons-lang:commons-lang:2.4 |  | 0 |  | 25
commons-lang3-3.3.2.jar |  | org.apache.commons:commons-lang3:3.3.2 |  | 0 |  | 26
commons-logging-1.1.1.jar |  | commons-logging:commons-logging:1.1.1 |  | 0 |  | 21
commons-pool-1.5.3.jar |  | commons-pool:commons-pool:1.5.3 |  | 0 |  | 25
commons-validator-1.4.0.jar |  | commons-validator:commons-validator:1.4.0 |  | 0 |  | 26
composer.lock |  |  |  | 0 |  | 1
daytrader-ear-2.1.7.ear |  |  |  | 0 |  | 2
daytrader-ear-2.1.7.ear: dt-ejb.jar | cpe:/a:apache:geronimo:2.1.7 | org.apache.geronimo.daytrader:daytrader-ejb:2.1.7 | High | 2 | HIGHEST | 15
daytrader-ear-2.1.7.ear: geronimo-jaxrpc_1.1_spec-2.0.0.jar |  | org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:2.0.0 |  | 0 |  | 18
daytrader-ear-2.1.7.ear: streamer.jar | cpe:/a:apache:apache_test:2.1.7 cpe:/a:apache:geronimo:2.1.7 | org.apache.geronimo.daytrader:daytrader-streamer:2.1.7 | High | 2 | HIGHEST | 17
daytrader-ear-2.1.7.ear: web.war |  |  |  | 0 |  | 5
daytrader-ear-2.1.7.ear: wsappclient.jar | cpe:/a:apache:geronimo:2.1.7 | org.apache.geronimo.daytrader:daytrader-wsappclient:2.1.7 | High | 2 | HIGHEST | 17
dependency-check-utils-1.4.4-SNAPSHOT.jar |  | org.owasp:dependency-check-utils:1.4.4-SNAPSHOT |  | 0 |  | 14
dojo-war-1.3.0.war | cpe:/a:dojotoolkit:dojo:1.3 | org.dojotoolkit:dojo-war:1.3.0 | High | 4 | HIGHEST | 12
dwr.jar | cpe:/a:getahead:direct_web_remoting:1.1.1 | uk.ltd.getahead:dwr:1.1.1 | High | 3 | HIGHEST | 7
ehcache-core-2.2.0.jar |  | net.sf.ehcache:ehcache-core:2.2.0 |  | 0 |  | 16
FileHelpers.2.0.0.0.nupkg | cpe:/a:file:file:2.0.0.0 |  | High | 1 | LOW | 2
FileHelpers.2.0.0.0.nupkg: FileHelpers.nuspec |  |  |  | 0 |  | 6
FileHelpers.2.0.0.0.nupkg: FileHelpers.dll |  |  |  | 0 |  | 4
FileHelpers.2.0.0.0.nupkg: FileHelpers.ExcelStorage.dll |  |  |  | 0 |  | 4
FileHelpers.2.0.0.0.nupkg: Interop.Excel.dll |  |  |  | 0 |  | 4
FileHelpers.2.0.0.0.nupkg: Interop.Office.dll |  |  |  | 0 |  | 4
freemarker-2.3.12.jar |  | org.freemarker:freemarker:2.3.12 |  | 0 |  | 18
geronimo-activation_1.1_spec-1.0.1.jar |  | org.apache.geronimo.specs:geronimo-activation_1.1_spec:1.0.1 |  | 0 |  | 18
geronimo-javamail_1.4_spec-1.2.jar |  | org.apache.geronimo.specs:geronimo-javamail_1.4_spec:1.2 |  | 0 |  | 18
geronimo-jms_1.1_spec-1.1.1.jar |  | org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1 |  | 0 |  | 18
geronimo-jpa_2.0_spec-1.1.jar |  | org.apache.geronimo.specs:geronimo-jpa_2.0_spec:1.1 |  | 0 |  | 22
geronimo-jta_1.1_spec-1.1.1.jar |  | org.apache.geronimo.specs:geronimo-jta_1.1_spec:1.1.1 |  | 0 |  | 18
geronimo-stax-api_1.0_spec-1.0.1.jar |  | org.apache.geronimo.specs:geronimo-stax-api_1.0_spec:1.0.1 |  | 0 |  | 18
guice-3.0.jar |  | com.google.inject:guice:3.0 |  | 0 |  | 22
h2-1.3.176.jar |  | com.h2database:h2:1.3.176 |  | 0 |  | 18
hamcrest-core-1.3.jar |  | org.hamcrest:hamcrest-core:1.3 |  | 0 |  | 17
hazelcast-2.5.jar |  | com.hazelcast:hazelcast:2.5 |  | 0 |  | 21
hibernate3.jar |  |  |  | 0 |  | 10
httpcore-4.0-beta1.jar |  | org.apache.httpcomponents:httpcore:4.0-beta1 |  | 0 |  | 15
httpcore-nio-4.0-beta1.jar |  | org.apache.httpcomponents:httpcore-nio:4.0-beta1 |  | 0 |  | 15
javax.inject-1.jar |  | javax.inject:javax.inject:1 |  | 0 |  | 13
javax.json-1.0.4.jar |  | org.glassfish:javax.json:1.0.4 |  | 0 |  | 20
jaxb-xercesImpl-1.5.jar |  | activesoap:jaxb-xercesImpl:1.5 |  | 0 |  | 22
jaxen-1.1.1.jar |  | jaxen:jaxen:1.1.1 |  | 0 |  | 19
jcip-annotations-1.0.jar |  | net.jcip:jcip-annotations:1.0 |  | 0 |  | 13
jetty-6.1.0.jar | cpe:/a:jetty:jetty:6.1.0 cpe:/a:mortbay:jetty:6.1.0 cpe:/a:mortbay_jetty:jetty:6.1 | org.mortbay.jetty:jetty:6.1.0 | High | 10 | HIGHEST | 14
jmockit-1.24.jar |  | org.jmockit:jmockit:1.24 |  | 0 |  | 13
jsoup-1.9.2.jar |  | org.jsoup:jsoup:1.9.2 |  | 0 |  | 17
jsr305-3.0.1.jar |  | com.google.code.findbugs:jsr305:3.0.1 |  | 0 |  | 15
junit-4.12.jar |  | junit:junit:4.12 |  | 0 |  | 17
junit4-ant-2.0.13.jar |  | com.carrotsearch.randomizedtesting:junit4-ant:2.0.13 |  | 0 |  | 15
log4net.2.0.3.nuspec | cpe:/a:apache:log4net:2.0.3 |  |  | 0 | LOW | 7
log4net.dll | cpe:/a:apache:log4net:1.2.13.0 |  |  | 0 | LOW | 5
logback-classic-1.1.7.jar |  | ch.qos.logback:logback-classic:1.1.7 |  | 0 |  | 19
logback-core-1.1.7.jar |  | ch.qos.logback:logback-core:1.1.7 |  | 0 |  | 19
lucene-analyzers-common-4.7.2.jar |  | org.apache.lucene:lucene-analyzers-common:4.7.2 |  | 0 |  | 21
lucene-codecs-4.7.2.jar |  | org.apache.lucene:lucene-codecs:4.7.2 |  | 0 |  | 21
lucene-core-4.7.2.jar |  | org.apache.lucene:lucene-core:4.7.2 |  | 0 |  | 20
lucene-queries-4.7.2.jar |  | org.apache.lucene:lucene-queries:4.7.2 |  | 0 |  | 22
lucene-queryparser-4.7.2.jar |  | org.apache.lucene:lucene-queryparser:4.7.2 |  | 0 |  | 22
lucene-sandbox-4.7.2.jar |  | org.apache.lucene:lucene-sandbox:4.7.2 |  | 0 |  | 22
lucene-test-framework-4.7.2.jar | cpe:/a:apache:apache_test:4.7.2 | org.apache.lucene:lucene-test-framework:4.7.2 |  | 0 | LOW | 20
mail-1.4.jar | cpe:/a:sun:javamail:1.4 | javax.mail:mail:1.4 | Medium | 1 | LOW | 20
mailapi-1.5.6.jar | cpe:/a:sun:javamail:1.5.6 | com.sun.mail:mailapi:1.5.6 | Medium | 1 | LOW | 27
maven-scm-api-1.8.1.jar |  | org.apache.maven.scm:maven-scm-api:1.8.1 |  | 0 |  | 18
maven-scm-provider-cvs-commons-1.8.1.jar |  | org.apache.maven.scm:maven-scm-provider-cvs-commons:1.8.1 |  | 0 |  | 18
maven-scm-provider-cvsexe-1.8.1.jar |  | org.apache.maven.scm:maven-scm-provider-cvsexe:1.8.1 |  | 0 |  | 18
mysql-connector-java-5.1.27-bin.jar | cpe:/a:mysql:mysql:5.1.27 |  | High | 97 | HIGHEST | 12
neethi-2.0.4.jar | cpe:/a:apache:apache_test:2.0.4 | org.apache.neethi:neethi:2.0.4 |  | 0 | LOW | 16
debug/package.json |  |  |  | 0 |  | 7
shelljs/package.json |  |  |  | 0 |  | 7
dns-sync/package.json | cpe:/a:dns-sync_project:dns-sync:0.1.0::~~~node.js~~ |  | High | 1 | HIGHEST | 6
ognl-2.6.11.jar |  | opensymphony:ognl:2.6.11 |  | 0 |  | 12
openjpa-2.0.1.jar | cpe:/a:apache:openjpa:2.0.1 | org.apache.openjpa:openjpa:2.0.1 | High | 1 | HIGHEST | 22
openssl\opensslv.h | cpe:/a:openssl:openssl:1.0.2c |  | High | 33 | HIGH | 4
org.mortbay.jetty.jar | cpe:/a:jetty:jetty:4.2.27 cpe:/a:mortbay:jetty:4.2.27 cpe:/a:mortbay_jetty:jetty:4.2.27 | jetty:jetty:4.2.27 | Medium | 5 | HIGHEST | 19
org.mortbay.jmx.jar |  |  |  | 0 |  | 3
plexus-utils-3.0.7.jar |  | org.codehaus.plexus:plexus-utils:3.0.7 |  | 0 |  | 17
EggTest-0.0.1-py2.7.egg |  |  |  | 0 |  | 7
Django-1.7.2-py2.py3-none-any.whl | cpe:/a:django_project:django:1.7.2 cpe:/a:djangoproject:django:1.7.2 |  | High | 14 | HIGHEST | 7
eggtest/__init__.py |  |  |  | 0 |  | 6
Django-1.7.2.dist-info/METADATA | cpe:/a:django_project:django:1.7.2 |  |  | 0 | LOW | 6
django/__init__.py |  |  |  | 0 |  | 1
EGG-INFO/PKG-INFO |  |  |  | 0 |  | 6
randomizedtesting-runner-2.0.13.jar |  | com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.0.13 |  | 0 |  | 17
regexp-1.3.jar |  | regexp:regexp:1.3 |  | 0 |  | 10
Gemfile.lock |  |  |  | 0 |  | 1
dalli-2.7.5.gemspec |  |  |  | 0 |  | 10
Gemfile.lock |  |  |  | 0 |  | 1
activerecord-oracle_enhanced-adapter-1.1.7.gemspec |  |  |  | 0 |  | 9
serp-1.13.1.jar |  | net.sourceforge.serp:serp:1.13.1 |  | 0 |  | 13
servlet-api-2.5.jar | cpe:/a:sun:one_application_server:2.5 | javax.servlet:servlet-api:2.5 | Medium | 3 | LOW | 16
slf4j-api-1.7.21.jar |  | org.slf4j:slf4j-api:1.7.21 |  | 0 |  | 20
spring-aop-3.0.0.RELEASE.jar |  | org.springframework:spring-aop:3.0.0.RELEASE |  | 0 |  | 19
spring-asm-3.0.0.RELEASE.jar |  | org.springframework:spring-asm:3.0.0.RELEASE |  | 0 |  | 19
spring-core-2.5.5.jar | cpe:/a:pivotal:spring_framework:2.5.5 cpe:/a:pivotal_software:spring_framework:2.5.5 cpe:/a:springsource:spring_framework:2.5.5 cpe:/a:vmware:springsource_spring_framework:2.5.5 | org.springframework:spring-core:2.5.5 | High | 7 | HIGHEST | 26
spring-core-3.0.0.RELEASE.jar | cpe:/a:pivotal:spring_framework:3.0.0 cpe:/a:pivotal_software:spring_framework:3.0.0 cpe:/a:springsource:spring_framework:3.0.0 cpe:/a:vmware:springsource_spring_framework:3.0.0 | org.springframework:spring-core:3.0.0.RELEASE | High | 8 | HIGHEST | 23
spring-expression-3.0.0.RELEASE.jar |  | org.springframework:spring-expression:3.0.0.RELEASE |  | 0 |  | 19
spring-retry-1.1.0.RELEASE.jar |  | org.springframework.retry:spring-retry:1.1.0.RELEASE |  | 0 |  | 14
spring-security-core-3.0.0.RELEASE.jar | cpe:/a:vmware:springsource_spring_security:3.0.0 | org.springframework.security:spring-security-core:3.0.0.RELEASE | Medium | 5 | HIGHEST | 17
spring-security-web-3.0.0.RELEASE.jar |  | org.springframework.security:spring-security-web:3.0.0.RELEASE |  | 0 |  | 14
spring-tx-3.0.0.RELEASE.jar |  | org.springframework:spring-tx:3.0.0.RELEASE |  | 0 |  | 18
stagedhttp-modified.tar: commons-httpclient-2.0.jar | cpe:/a:apache:commons-httpclient:2.0 cpe:/a:apache:httpclient:2.0 | commons-httpclient:commons-httpclient:2.0 | Medium | 2 | LOW | 17
stagedhttp-modified.tar: commons-logging.jar |  | commons-logging:commons-logging:1.0.3 |  | 0 |  | 18
stagedhttp-modified.tar: dom4j.jar |  | dom4j:dom4j:1.4 |  | 0 |  | 14
stagedhttp-modified.tar: jgroups-all.jar |  | jgroups:jgroups-all:2.2.7 |  | 0 |  | 8
stagedhttp-modified.tar: log4j.jar |  |  |  | 0 |  | 7
stagedhttp-modified.tar: mail.jar | cpe:/a:sun:javamail:1.3.2 |  | Medium | 3 | HIGH | 11
stagedhttp-modified.tar: serializer.jar |  |  |  | 0 |  | 11
stagedhttp-modified.tar: xalan.jar | cpe:/a:apache:xalan-java:2.7.0 |  | High | 1 | MEDIUM | 28
stagedhttp-modified.tar: xmlsec-1.3.0.jar |  | org.codehaus.xfire:xmlsec:1.3.0 |  | 0 |  | 21
stagedhttp-modified.tar: xss4j.jar |  |  |  | 0 |  | 4
struts.jar | cpe:/a:apache:struts:1.2.7 | struts:struts:1.2.7 | High | 10 | HIGHEST | 20
struts2-core-2.1.2.jar | cpe:/a:apache:struts:2.1.2 | org.apache.struts:struts2-core:2.1.2 | High | 32 | HIGHEST | 16
EasyPeasy.podspec |  |  |  | 0 |  | 7
Gloss.podspec |  |  |  | 0 |  | 8
uber-1.0-SNAPSHOT.jar |  |  |  | 0 |  | 2
velocity-1.7.jar |  | org.apache.velocity:velocity:1.7 |  | 0 |  | 27
war-4.0.war |  | org.glassfish.main.admingui:war:4.0 |  | 0 |  | 9
war-4.0.war: commons-fileupload-1.1.1.jar | cpe:/a:apache:commons_fileupload:1.1.1 | commons-fileupload:commons-fileupload:1.1.1 | High | 3 | HIGHEST | 22
war-4.0.war: commons-io-1.3.1.jar |  | commons-io:commons-io:1.3.1 |  | 0 |  | 22
war-4.0.war: dojo-ajax-nodemo-0.4.1.jar | cpe:/a:sun:woodstock:0.4.1 | com.sun.woodstock.dependlibs:dojo-ajax-nodemo:0.4.1 |  | 0 | LOW | 8
war-4.0.war: json-1.0.jar | cpe:/a:sun:woodstock:1.0 | com.sun.woodstock.dependlibs:json:1.0 |  | 0 | LOW | 9
war-4.0.war: prototype-1.5.0.jar | cpe:/a:sun:woodstock:1.5.0 | com.sun.woodstock.dependlibs:prototype:1.5.0 |  | 0 | LOW | 8
war-4.0.war: webui-jsf-4.0.2.10.jar |  | com.sun.woodstock:webui-jsf:4.0.2.10 |  | 0 |  | 22
war-4.0.war: webui-jsf-suntheme-4.0.2.10.jar |  | com.sun.woodstock:webui-jsf-suntheme:4.0.2.10 |  | 0 |  | 18
war-4.0.war: console-core-4.0.jar |  | org.glassfish.main.admingui:console-core:4.0 |  | 0 |  | 15
woden-api-1.0M8.jar |  | org.apache.woden:woden-api:1.0M8 |  | 0 |  | 16
woden-impl-dom-1.0M8.jar |  | org.apache.woden:woden-impl-dom:1.0M8 |  | 0 |  | 16
wsdl4j-1.6.2.jar |  | wsdl4j:wsdl4j:1.6.2 |  | 0 |  | 19
wstx-asl-3.2.4.jar |  | org.codehaus.woodstox:wstx-asl:3.2.4 |  | 0 |  | 20
xalan-2.7.0.jar | cpe:/a:apache:xalan-java:2.7.0 | xalan:xalan:2.7.0 | High | 1 | HIGHEST | 28
xercesImpl-2.8.1.jar |  | xerces:xercesImpl:2.8.1 |  | 0 |  | 55
xml-apis-1.0.b2.jar |  | xml-apis:xml-apis:1.0.b2 |  | 0 |  | 35
xmlParserAPIs-2.6.0.jar |  | xerces:xmlParserAPIs:2.6.0 |  | 0 |  | 31
xmlpull-1.1.3.1.jar |  | xmlpull:xmlpull:1.1.3.1 |  | 0 |  | 12
XmlSchema-1.4.2.jar |  | org.apache.ws.commons.schema:XmlSchema:1.4.2 |  | 0 |  | 17
xpp3_min-1.1.4c.jar |  | xpp3:xpp3_min:1.1.4c |  | 0 |  | 14
xstream-1.4.8.jar | cpe:/a:x-stream:xstream:1.4.8 | com.thoughtworks.xstream:xstream:1.4.8 | Medium | 1 | HIGHEST | 27
xwork-2.1.1.jar | cpe:/a:opensymphony:xwork:2.1.1 | com.opensymphony:xwork:2.1.1 | Medium | 3 | HIGHEST | 14
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-core/pom.xml |  | org.hibernate:hibernate-core:3.6.6.Final |  | 0 |  | 7
junit4-ant-2.0.13.jar\META-INF/maven/com.google.guava/guava/pom.xml |  | com.google.guava:guava:14.0.1 |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-commons-annotations/pom.xml |  | org.hibernate:hibernate-commons-annotations:3.2.0.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-ehcache/pom.xml |  | org.hibernate:hibernate-ehcache:3.6.6.Final |  | 0 |  | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.owasp.dependency-check/uber/pom.xml |  | org.owasp.dependency-check:uber:1.0-SNAPSHOT |  | 0 |  | 5
junit4-ant-2.0.13.jar\META-INF/maven/commons-io/commons-io/pom.xml |  | commons-io:commons-io:2.3 |  | 0 |  | 9
junit4-ant-2.0.13.jar\META-INF/maven/org.simpleframework/simple-xml/pom.xml |  | org.simpleframework:simple-xml:2.6.2 |  | 0 |  | 6
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-jbosscache/pom.xml |  | org.hibernate:hibernate-jbosscache:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-infinispan/pom.xml |  | org.hibernate:hibernate-infinispan:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-testing/pom.xml |  | org.hibernate:hibernate-testing:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-oscache/pom.xml |  | org.hibernate:hibernate-oscache:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-swarmcache/pom.xml |  | org.hibernate:hibernate-swarmcache:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-c3p0/pom.xml |  | org.hibernate:hibernate-c3p0:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-proxool/pom.xml |  | org.hibernate:hibernate-proxool:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-entitymanager/pom.xml |  | org.hibernate:hibernate-entitymanager:3.6.6.Final |  | 0 |  | 7
hibernate3.jar\META-INF/maven/org.hibernate/hibernate-envers/pom.xml |  | org.hibernate:hibernate-envers:3.6.6.Final |  | 0 |  | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/commons-io/commons-io/pom.xml |  | commons-io:commons-io:1.3.2 |  | 0 |  | 9
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.dropwizard/dropwizard-core/pom.xml |  | com.yammer.dropwizard:dropwizard-core:0.1.3 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-core/pom.xml |  | com.sun.jersey:jersey-core:1.11 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-server/pom.xml |  | com.sun.jersey:jersey-server:1.11 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-servlet/pom.xml |  | com.sun.jersey:jersey-servlet:1.11 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-core/pom.xml |  | com.yammer.metrics:metrics-core:2.0.0-RC0 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-servlet/pom.xml |  | com.yammer.metrics:metrics-servlet:2.0.0-RC0 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jetty/pom.xml | cpe:/a:jetty:jetty:2.0.0.rc0 | com.yammer.metrics:metrics-jetty:2.0.0-RC0 |  | 0 | LOW | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-log4j/pom.xml |  | com.yammer.metrics:metrics-log4j:2.0.0-RC0 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/log4j/log4j/pom.xml |  | log4j:log4j:1.2.16 |  | 0 |  | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jersey/pom.xml |  | com.yammer.metrics:metrics-jersey:2.0.0-RC0 |  | 0 |  | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-annotation/pom.xml |  | com.yammer.metrics:metrics-annotation:2.0.0-RC0 |  | 0 |  | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-api/pom.xml |  | org.slf4j:slf4j-api:1.6.4 |  | 0 |  | 8
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-log4j12/pom.xml |  | org.slf4j:slf4j-log4j12:1.6.4 |  | 0 |  | 8
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/jul-to-slf4j/pom.xml |  | org.slf4j:jul-to-slf4j:1.6.4 |  | 0 |  | 8
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-server/pom.xml | cpe:/a:jetty:jetty:7.6.0.rc4 | org.eclipse.jetty:jetty-server:7.6.0.RC4 |  | 0 | LOW | 8
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-continuation/pom.xml | cpe:/a:jetty:jetty:7.6.0.rc4 | org.eclipse.jetty:jetty-continuation:7.6.0.RC4 |  | 0 | LOW | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-servlet/pom.xml | cpe:/a:jetty:jetty:7.6.0.rc4 | org.eclipse.jetty:jetty-servlet:7.6.0.RC4 |  | 0 | LOW | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-security/pom.xml | cpe:/a:jetty:jetty:7.6.0.rc4 | org.eclipse.jetty:jetty-security:7.6.0.RC4 |  | 0 | LOW | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-http/pom.xml | cpe:/a:jetty:jetty:7.6.0.rc4 | org.eclipse.jetty:jetty-http:7.6.0.RC4 |  | 0 | LOW | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-io/pom.xml |  | org.eclipse.jetty:jetty-io:7.6.0.RC4 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-util/pom.xml | cpe:/a:jetty:jetty:7.6.0.rc4 | org.eclipse.jetty:jetty-util:7.6.0.RC4 |  | 0 | LOW | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.google.guava/guava/pom.xml |  | com.google.guava:guava:11.0.1 |  | 0 |  | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.hibernate/hibernate-validator/pom.xml | cpe:/a:hibernate:hibernate_validator:4.2.0 | org.hibernate:hibernate-validator:4.2.0.Final | Medium | 1 | HIGHEST | 7
uber-1.0-SNAPSHOT.jar\META-INF/maven/com.googlecode.jtype/jtype/pom.xml |  | com.googlecode.jtype:jtype:0.1.1 |  | 0 |  | 6
uber-1.0-SNAPSHOT.jar\META-INF/maven/javax.validation/validation-api/pom.xml |  | javax.validation:validation-api:1.0.0.GA |  | 0 |  | 5
uber-1.0-SNAPSHOT.jar\META-INF/maven/org.yaml/snakeyaml/pom.xml |  | org.yaml:snakeyaml:1.9 |  | 0 |  | 6
ffmpeg\ffmpeg_version.cmake:libavformat |  |  |  | 0 |  | 2
ffmpeg\ffmpeg_version.cmake:libavutil |  |  |  | 0 |  | 2
ffmpeg\ffmpeg_version.cmake:libswscale |  |  |  | 0 |  | 2
ffmpeg\ffmpeg_version.cmake:libavresample |  |  |  | 0 |  | 2
composer.lock:classpreloader/classpreloader |  |  |  | 0 |  | 3
composer.lock:danielstjules/stringy |  |  |  | 0 |  | 3
composer.lock:dnoegel/php-xdg-base-dir |  |  |  | 0 |  | 3
composer.lock:doctrine/inflector |  |  |  | 0 |  | 3
composer.lock:jakub-onderka/php-console-color |  |  |  | 0 |  | 3
composer.lock:jakub-onderka/php-console-highlighter |  |  |  | 0 |  | 3
composer.lock:jeremeamia/SuperClosure |  |  |  | 0 |  | 3
composer.lock:laravel/framework |  |  |  | 0 |  | 3
composer.lock:laravel/laravel |  |  |  | 0 |  | 3
composer.lock:league/flysystem |  |  |  | 0 |  | 3
composer.lock:monolog/monolog |  |  |  | 0 |  | 3
composer.lock:mtdowling/cron-expression |  |  |  | 0 |  | 3
composer.lock:nesbot/carbon |  |  |  | 0 |  | 3
composer.lock:nikic/php-parser |  |  |  | 0 |  | 3
composer.lock:psr/log |  |  |  | 0 |  | 3
composer.lock:psy/psysh |  |  |  | 0 |  | 3
composer.lock:swiftmailer/swiftmailer |  |  |  | 0 |  | 3
composer.lock:symfony/console |  |  |  | 0 |  | 4
composer.lock:symfony/css-selector |  |  |  | 0 |  | 4
composer.lock:symfony/debug |  |  |  | 0 |  | 4
composer.lock:symfony/dom-crawler |  |  |  | 0 |  | 4
composer.lock:symfony/event-dispatcher |  |  |  | 0 |  | 4
composer.lock:symfony/finder |  |  |  | 0 |  | 4
composer.lock:symfony/http-foundation |  |  |  | 0 |  | 4
composer.lock:symfony/http-kernel |  |  |  | 0 |  | 4
composer.lock:symfony/process |  |  |  | 0 |  | 4
composer.lock:symfony/routing |  |  |  | 0 |  | 4
composer.lock:symfony/translation |  |  |  | 0 |  | 4
composer.lock:symfony/var-dumper |  |  |  | 0 |  | 4
composer.lock:vlucas/phpdotenv |  |  |  | 0 |  | 3

## Dependencies

### activation-1.1.jar

Description: JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).

License:

    Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\activation-1.1.jar
MD5: 8ae38e87cd4f86059c0294a8fe3e0b18
SHA1: e6cb541461c2834bdea3eb920f1884d1eb508b50

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | activation
central | groupid | javax.activation
central | version | 1.1
file | name | activation
file | version | 1.1
jar | package name | activation
jar | package name | javax
Manifest | extension-name | javax.activation
Manifest | Implementation-Vendor | Sun Microsystems, Inc.
Manifest | Implementation-Vendor-Id | com.sun
Manifest | Implementation-Version | 1.1
Manifest | specification-title | JavaBeans(TM) Activation Framework Specification
Manifest | specification-vendor | Sun Microsystems, Inc.
pom | artifactid | activation
pom | description | JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).
pom | groupid | javax.activation
pom | name | JavaBeans Activation Framework (JAF)
pom | url | http://java.sun.com/products/javabeans/jaf/index.jsp
pom | version | 1.1

#### Identifiers

- maven: javax.activation:activation:1.1 Confidence:HIGHEST

### annogen-0.1.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\annogen-0.1.0.jar
MD5: ff275c3491ac6715ad9f6c22a9660503
SHA1: a8de34ea7aa93765d24dc16ec9c61af5160bb899

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | annogen
central | groupid | annogen
central | version | 0.1.0
file | name | annogen
file | version | 0.1.0
jar | package name | codehaus
jar | package name | internal
jar | package name | jam
pom | artifactid | annogen
pom | groupid | annogen
pom | version | 0.1.0

#### Identifiers

- maven: annogen:annogen:0.1.0 Confidence:HIGHEST

### annotations-3.0.1u2.jar

Description: Annotation the FindBugs tool supports

License:

    GNU Lesser Public License: http://www.gnu.org/licenses/lgpl.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\annotations-3.0.1u2.jar
MD5: 4242c4e6b7719eeb3f91d3fe4c7af12c
SHA1: 89a670596c98e416fb2583c08ae34cc5c3ce2097

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | annotations
central | groupid | com.google.code.findbugs
central | version | 3.0.1u2
file | name | annotations
file | version | 3.0.1.u2
jar | package name | annotation
jar | package name | javax
manifest | Bundle-Description | Annotation the FindBugs tool supports
Manifest | Bundle-Name | FindBugs-Annotations
Manifest | bundle-requiredexecutionenvironment | J2SE-1.5
Manifest | bundle-symbolicname | findbugsAnnotations
Manifest | Bundle-Version | 3.0.1
pom | artifactid | annotations
pom | description | Annotation the FindBugs tool supports
pom | groupid | google.code.findbugs
pom | name | FindBugs-Annotations
pom | url | http://findbugs.sourceforge.net/
pom | version | 3.0.1u2

#### Identifiers

- maven: com.google.code.findbugs:annotations:3.0.1u2 Confidence:HIGHEST

### ant-1.9.7.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ant-1.9.7.jar
MD5: a14502c25ee6bc76c4614315845b29e9
SHA1: 3b2a10512ee6537d3852c9b693a0284dcab5de68

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | ant
central | groupid | org.apache.ant
central | version | 1.9.7
file | name | ant
file | version | 1.9.7
jar | package name | ant
jar | package name | apache
jar | package name | tools
manifest: org/apache/tools/ant/ | Implementation-Title | org.apache.tools.ant
manifest: org/apache/tools/ant/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/tools/ant/ | Implementation-Version | 1.9.7
manifest: org/apache/tools/ant/ | Specification-Title | Apache Ant
pom | artifactid | ant
pom | groupid | apache.ant
pom | name | Apache Ant Core
pom | parent-artifactid | ant-parent
pom | parent-groupid | org.apache.ant
pom | url | http://ant.apache.org/
pom | version | 1.9.7

#### Identifiers

- maven: org.apache.ant:ant:1.9.7 Confidence:HIGHEST

### aopalliance-1.0.jar

Description: AOP Alliance

License:

    Public Domain

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | aopalliance
central | groupid | aopalliance
central | version | 1.0
file | name | aopalliance
file | version | 1.0
jar | package name | aopalliance
jar | package name | intercept
pom | artifactid | aopalliance
pom | description | AOP Alliance
pom | groupid | aopalliance
pom | name | AOP alliance
pom | url | http://aopalliance.sourceforge.net
pom | version | 1.0

#### Identifiers

- maven: aopalliance:aopalliance:1.0 Confidence:HIGHEST

### aspectjrt-1.6.5.jar

Description: The runtime needed to execute a program using AspectJ

License:

    Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\aspectjrt-1.6.5.jar
MD5: 71d9982a11bf94ac21221e2f052f3869
SHA1: d35f32a63eb823dc2dffc7ee6fdb8e00a680d114

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | aspectjrt
central | groupid | org.aspectj
central | version | 1.6.5
file | name | aspectjrt
file | version | 1.6.5
jar | package name | aspectj
jar | package name | lang
jar | package name | reflect
manifest: org/aspectj/lang/ | Implementation-Title | org.aspectj.tools
manifest: org/aspectj/lang/ | Implementation-Vendor | aspectj.org
manifest: org/aspectj/lang/ | Implementation-Version | 1.6.5
manifest: org/aspectj/lang/ | Specification-Title | AspectJ Runtime Classes
pom | artifactid | aspectjrt
pom | description | The runtime needed to execute a program using AspectJ
pom | groupid | aspectj
pom | name | AspectJ runtime
pom | url | http://www.aspectj.org
pom | version | 1.6.5

#### Identifiers

- maven: org.aspectj:aspectjrt:1.6.5 Confidence:HIGHEST

### aspectjweaver-1.6.5.jar

Description: The AspectJ weaver introduces advices to java classes

License:

    Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\aspectjweaver-1.6.5.jar
MD5: 2fa7d0e921c46245d0e1b39f3ac365f5
SHA1: 3ead0550dc9e2e0a5abd0fdb3116e636b59e4dc4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | aspectjweaver
central | groupid | org.aspectj
central | version | 1.6.5
file | name | aspectjweaver
file | version | 1.6.5
jar | package name | aspectj
jar | package name | weaver
Manifest | Implementation-Title | org.aspectj.weaver
Manifest | Implementation-Vendor | aspectj.org
Manifest | Implementation-Version | 1.6.5
Manifest | name | org/aspectj/weaver/
Manifest | specification-title | AspectJ Weaver Classes
Manifest | specification-vendor | aspectj.org
pom | artifactid | aspectjweaver
pom | description | The AspectJ weaver introduces advices to java classes
pom | groupid | aspectj
pom | name | AspectJ weaver
pom | url | http://www.aspectj.org
pom | version | 1.6.5

#### Identifiers

- maven: org.aspectj:aspectjweaver:1.6.5 Confidence:HIGHEST

### binutils/configure

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\binutils\configure
MD5: 87ef7e524d4c3190c297ce64df0e600e
SHA1: ed33427ceee41faa5e69fb89452cd69318e3723a

#### Evidence

Source | Name | Value
--- | --- | ---
configure | NAME | binutils
configure | TARNAME | binutils
configure | VERSION | 2.25.51
file | name | configure

#### Identifiers

- None

### binutils/configure.ac

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\binutils\configure.ac
MD5: 1982a659f09482b4eabbf19a000822fa
SHA1: 4dd69b029c1e0ebd8a087f0ef14742e83708b79a

#### Evidence

Source | Name | Value
--- | --- | ---
configure.ac | Package | binutils
configure.ac | Package Version | BFD_VERSION
file | name | configure

#### Identifiers

- None

### ghostscript/configure.ac

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\ghostscript\configure.ac
MD5: a7e8bdc5c0dab93d042e822130b8cfc9
SHA1: 94d7acda832dc53ab91892dcdd4b1ac9fc191e75

#### Evidence

Source | Name | Value
--- | --- | ---
configure.ac | Bug report address | gnu-ghostscript-bug@gnu.org
configure.ac | Package | gnu-ghostscript
configure.ac | Package Version | 8.62.0
file | name | configure

#### Identifiers

- cpe: cpe:/a:ghostscript:ghostscript:8.62 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2009-0792

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.

- BUGTRAQ - 20090417 rPSA-2009-0060-1 ghostscript
- CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2009-155.htm
- CONFIRM - http://wiki.rpath.com/Advisories:rPSA-2009-0060
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=491853
- FEDORA - FEDORA-2009-3430
- FEDORA - FEDORA-2009-3435
- FEDORA - FEDORA-2009-3709
- FEDORA - FEDORA-2009-3710
- MANDRIVA - MDVSA-2009:095
- MANDRIVA - MDVSA-2009:096
- REDHAT - RHSA-2009:0420
- REDHAT - RHSA-2009:0421
- SECUNIA - 34373
- SECUNIA - 34667
- SECUNIA - 34711
- SECUNIA - 34726
- SECUNIA - 34729
- SECUNIA - 34732
- SECUNIA - 35416
- SECUNIA - 35559
- SECUNIA - 35569
- SUNALERT - 262288
- SUSE - SUSE-SR:2009:009
- SUSE - SUSE-SR:2009:011
- UBUNTU - USN-757-1
- VUPEN - ADV-2009-1708
- XF - ghostscript-icc-bo(50381)

Vulnerable Software & Versions: (show all)

- cpe:/a:ghostscript:ghostscript:8.62
- ...
- cpe:/a:argyllcms:argyllcms:0.1.0
- cpe:/a:argyllcms:argyllcms:0.2.0
- cpe:/a:argyllcms:argyllcms:0.2.1
- cpe:/a:argyllcms:argyllcms:0.2.2
- cpe:/a:argyllcms:argyllcms:0.3.0
- cpe:/a:argyllcms:argyllcms:0.6.0
- cpe:/a:argyllcms:argyllcms:0.7.0:beta_8
- cpe:/a:argyllcms:argyllcms:1.0.0
- cpe:/a:argyllcms:argyllcms:1.0.2
- cpe:/a:argyllcms:argyllcms:1.0.3 and all previous versions
- cpe:/a:ghostscript:ghostscript:5.50
- cpe:/a:ghostscript:ghostscript:7.05
- cpe:/a:ghostscript:ghostscript:7.07
- cpe:/a:ghostscript:ghostscript:8.0.1
- cpe:/a:ghostscript:ghostscript:8.15
- cpe:/a:ghostscript:ghostscript:8.15.2
- cpe:/a:ghostscript:ghostscript:8.54
- cpe:/a:ghostscript:ghostscript:8.56
- cpe:/a:ghostscript:ghostscript:8.57
- cpe:/a:ghostscript:ghostscript:8.61
- cpe:/a:ghostscript:ghostscript:8.62
- cpe:/a:ghostscript:ghostscript:8.63
- cpe:/a:ghostscript:ghostscript:8.64 and all previous versions

CVE-2009-0584

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors

icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

- AUSCERT - ESB-2009.0259
- BID - 34184
- BUGTRAQ - 20090319 rPSA-2009-0050-1 ghostscript
- CONFIRM - http://bugs.gentoo.org/show_bug.cgi?id=261087
- CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm
- CONFIRM - http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=487744
- CONFIRM - https://issues.rpath.com/browse/RPL-2991
- DEBIAN - DSA-1746
- FEDORA - FEDORA-2009-2883
- FEDORA - FEDORA-2009-2885
- FEDORA - FEDORA-2009-3011
- FEDORA - FEDORA-2009-3031
- GENTOO - GLSA-200903-37
- MANDRIVA - MDVSA-2009:095
- MANDRIVA - MDVSA-2009:096
- OSVDB - 52988
- REDHAT - RHSA-2009:0345
- SECTRACK - 1021868
- SECUNIA - 34266
- SECUNIA - 34373
- SECUNIA - 34381
- SECUNIA - 34393
- SECUNIA - 34398
- SECUNIA - 34418
- SECUNIA - 34437
- SECUNIA - 34443
- SECUNIA - 34469
- SECUNIA - 34729
- SECUNIA - 35559
- SECUNIA - 35569
- SUNALERT - 262288
- SUSE - SUSE-SR:2009:007
- UBUNTU - USN-743-1
- UBUNTU - USN-757-1
- VUPEN - ADV-2009-0776
- VUPEN - ADV-2009-0777
- VUPEN - ADV-2009-0816
- VUPEN - ADV-2009-1708
- XF - ghostscript-icclib-bo(49327)

Vulnerable Software & Versions: (show all)

- cpe:/a:ghostscript:ghostscript:8.64 and all previous versions
- ...
- cpe:/a:argyllcms:cms:1.0.3 and all previous versions
- cpe:/a:ghostscript:ghostscript:0
- cpe:/a:ghostscript:ghostscript:5.50
- cpe:/a:ghostscript:ghostscript:7.05
- cpe:/a:ghostscript:ghostscript:7.07
- cpe:/a:ghostscript:ghostscript:8.0.1
- cpe:/a:ghostscript:ghostscript:8.15
- cpe:/a:ghostscript:ghostscript:8.15.2
- cpe:/a:ghostscript:ghostscript:8.54
- cpe:/a:ghostscript:ghostscript:8.56
- cpe:/a:ghostscript:ghostscript:8.57
- cpe:/a:ghostscript:ghostscript:8.60
- cpe:/a:ghostscript:ghostscript:8.61
- cpe:/a:ghostscript:ghostscript:8.64 and all previous versions

CVE-2009-0583

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.

- AUSCERT - ESB-2009.0259
- BID - 34184
- BUGTRAQ - 20090319 rPSA-2009-0050-1 ghostscript
- CONFIRM - http://bugs.gentoo.org/show_bug.cgi?id=261087
- CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2009-098.htm
- CONFIRM - http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0050
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=487742
- CONFIRM - https://issues.rpath.com/browse/RPL-2991
- DEBIAN - DSA-1746
- FEDORA - FEDORA-2009-2883
- FEDORA - FEDORA-2009-2885
- FEDORA - FEDORA-2009-3011
- FEDORA - FEDORA-2009-3031
- GENTOO - GLSA-200903-37
- MANDRIVA - MDVSA-2009:095
- MANDRIVA - MDVSA-2009:096
- REDHAT - RHSA-2009:0345
- SECTRACK - 1021868
- SECUNIA - 34266
- SECUNIA - 34373
- SECUNIA - 34381
- SECUNIA - 34393
- SECUNIA - 34398
- SECUNIA - 34418
- SECUNIA - 34437
- SECUNIA - 34443
- SECUNIA - 34469
- SECUNIA - 34729
- SECUNIA - 35559
- SECUNIA - 35569
- SUNALERT - 262288
- SUSE - SUSE-SR:2009:007
- UBUNTU - USN-743-1
- UBUNTU - USN-757-1
- VUPEN - ADV-2009-0776
- VUPEN - ADV-2009-0777
- VUPEN - ADV-2009-0816
- VUPEN - ADV-2009-1708
- XF - ghostscript-icclib-native-color-bo(49329)

Vulnerable Software & Versions: (show all)

- cpe:/a:ghostscript:ghostscript:8.62
- ...
- cpe:/a:argyllcms:argyllcms:0.1.0
- cpe:/a:argyllcms:argyllcms:0.2.0
- cpe:/a:argyllcms:argyllcms:0.2.1
- cpe:/a:argyllcms:argyllcms:0.2.2
- cpe:/a:argyllcms:argyllcms:0.3.0
- cpe:/a:argyllcms:argyllcms:0.6.0
- cpe:/a:argyllcms:argyllcms:0.7.0:beta_8
- cpe:/a:argyllcms:argyllcms:1.0.0
- cpe:/a:argyllcms:argyllcms:1.0.2
- cpe:/a:argyllcms:argyllcms:1.0.3 and all previous versions
- cpe:/a:ghostscript:ghostscript:5.50
- cpe:/a:ghostscript:ghostscript:7.05
- cpe:/a:ghostscript:ghostscript:7.07
- cpe:/a:ghostscript:ghostscript:8.0.1
- cpe:/a:ghostscript:ghostscript:8.15
- cpe:/a:ghostscript:ghostscript:8.15.2
- cpe:/a:ghostscript:ghostscript:8.54
- cpe:/a:ghostscript:ghostscript:8.56
- cpe:/a:ghostscript:ghostscript:8.57
- cpe:/a:ghostscript:ghostscript:8.61
- cpe:/a:ghostscript:ghostscript:8.62
- cpe:/a:ghostscript:ghostscript:8.63
- cpe:/a:ghostscript:ghostscript:8.64 and all previous versions

CVE-2009-0196

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.

- BID - 34445
- BUGTRAQ - 20090409 Secunia Research: Ghostscript jbig2dec JBIG2 Processing Buffer Overflow
- BUGTRAQ - 20090417 rPSA-2009-0060-1 ghostscript
- CONFIRM - http://wiki.rpath.com/Advisories:rPSA-2009-0060
- FEDORA - FEDORA-2009-3709
- FEDORA - FEDORA-2009-3710
- MANDRIVA - MDVSA-2009:095
- MISC - http://secunia.com/secunia_research/2009-21/
- MISC - https://bugzilla.redhat.com/attachment.cgi?id=337747
- OSVDB - 53492
- REDHAT - RHSA-2009:0421
- SECTRACK - 1022029
- SECUNIA - 34292
- SECUNIA - 34667
- SECUNIA - 34729
- SECUNIA - 34732
- SECUNIA - 35416
- SECUNIA - 35559
- SECUNIA - 35569
- SUNALERT - 262288
- SUSE - SUSE-SR:2009:009
- SUSE - SUSE-SR:2009:011
- UBUNTU - USN-757-1
- VUPEN - ADV-2009-0983
- VUPEN - ADV-2009-1708

Vulnerable Software & Versions: (show all)

- cpe:/a:ghostscript:ghostscript:8.62
- ...
- cpe:/a:ghostscript:ghostscript:0
- cpe:/a:ghostscript:ghostscript:5.50
- cpe:/a:ghostscript:ghostscript:7.07
- cpe:/a:ghostscript:ghostscript:8.0.1
- cpe:/a:ghostscript:ghostscript:8.15
- cpe:/a:ghostscript:ghostscript:8.15.2
- cpe:/a:ghostscript:ghostscript:8.54
- cpe:/a:ghostscript:ghostscript:8.56
- cpe:/a:ghostscript:ghostscript:8.57
- cpe:/a:ghostscript:ghostscript:8.60
- cpe:/a:ghostscript:ghostscript:8.61
- cpe:/a:ghostscript:ghostscript:8.62
- cpe:/a:ghostscript:ghostscript:8.63
- cpe:/a:ghostscript:ghostscript:8.64 and all previous versions

CVE-2008-6679

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly other versions, allows remote attackers to cause a denial of service (ps2pdf crash) and possibly execute arbitrary code via a crafted Postscript file.

- BUGTRAQ - 20090417 rPSA-2009-0060-1 ghostscript
- CONFIRM - http://bugs.ghostscript.com/show_bug.cgi?id=690211
- CONFIRM - http://wiki.rpath.com/Advisories:rPSA-2009-0060
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=493445
- FEDORA - FEDORA-2009-3709
- FEDORA - FEDORA-2009-3710
- MANDRIVA - MDVSA-2009:095
- MLIST - [oss-security] 20090401 CVE request -- ghostscript
- REDHAT - RHSA-2009:0421
- SECUNIA - 34667
- SECUNIA - 34729
- SECUNIA - 34732
- SECUNIA - 35416
- SECUNIA - 35559
- SECUNIA - 35569
- SUNALERT - 262288
- SUSE - SUSE-SR:2009:011
- UBUNTU - USN-757-1
- VUPEN - ADV-2009-1708

Vulnerable Software & Versions:

- cpe:/a:ghostscript:ghostscript:8.62

### readable-code/configure

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\readable-code\configure
MD5: e4b0986a605c8d223bcd8cbf036caae8
SHA1: cd18db2a682ef6c3deeeab099d2036e405a1f07c

#### Evidence

Source | Name | Value
--- | --- | ---
configure | BUGREPORT | dwheeler@dwheeler.com
configure | NAME | readable
configure | TARNAME | readable
configure | URL | http://readable.sourceforge.net/
configure | VERSION | 1.0.7
file | name | configure

#### Identifiers

- None

### readable-code/configure.ac

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\autoconf\readable-code\configure.ac
MD5: d130e2fa32a516b4898b3de12b1b42bc
SHA1: 5dba846da57603462614e4b6801cc82655519023

#### Evidence

Source | Name | Value
--- | --- | ---
configure.ac | Bug report address | dwheeler@dwheeler.com
configure.ac | Package | readable
configure.ac | Package Version | 1.0.7
configure.ac | Tarname | readable
configure.ac | URL | http://readable.sourceforge.net/
file | name | configure

#### Identifiers

- None

### axiom-api-1.2.7.jar

Description: The Axiom API

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axiom-api-1.2.7.jar
MD5: b06e716d6e5c3a0e3289d28126d01121
SHA1: aa260a5f3fcaee3b95b551a9bbcbe63f56e5a2ad

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | axiom-api
central | groupid | org.apache.ws.commons.axiom
central | version | 1.2.7
file | name | axiom-api
file | version | 1.2.7
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Axiom API
Manifest | bundle-symbolicname | org.apache.ws.commons.axiom.axiom-api
Manifest | Bundle-Version | 1.2.7
pom | artifactid | axiom-api
pom | description | The Axiom API
pom | groupid | apache.ws.commons.axiom
pom | name | Axiom API
pom | parent-artifactid | axiom
pom | parent-groupid | org.apache.ws.commons.axiom
pom | version | 1.2.7

#### Identifiers

- maven: org.apache.ws.commons.axiom:axiom-api:1.2.7 Confidence:HIGHEST

### axiom-dom-1.2.7.jar

Description: The Axiom DOM implementation.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axiom-dom-1.2.7.jar
MD5: 9d1ff1229a42b8a93fc1db8c349ce830
SHA1: 34f6d22244963bc617f3971a826104162eef1da4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | axiom-dom
central | groupid | org.apache.ws.commons.axiom
central | version | 1.2.7
file | name | axiom-dom
file | version | 1.2.7
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Axiom DOM
Manifest | bundle-symbolicname | org.apache.ws.commons.axiom.axiom-dom
Manifest | Bundle-Version | 1.2.7
pom | artifactid | axiom-dom
pom | description | The Axiom DOM implementation.
pom | groupid | apache.ws.commons.axiom
pom | name | Axiom DOM
pom | parent-artifactid | axiom
pom | parent-groupid | org.apache.ws.commons.axiom
pom | version | 1.2.7

#### Identifiers

- maven: org.apache.ws.commons.axiom:axiom-dom:1.2.7 Confidence:HIGHEST

### axiom-impl-1.2.7.jar

Description: The Axiom default implementation.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axiom-impl-1.2.7.jar
MD5: b58763085089fe3d4d106386323ccd63
SHA1: 378b814d1a6129a3e8175d95cf60d48c60ae9d51

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | axiom-impl
central | groupid | org.apache.ws.commons.axiom
central | version | 1.2.7
file | name | axiom-impl
file | version | 1.2.7
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Axiom API
Manifest | bundle-symbolicname | org.apache.ws.commons.axiom.axiom-impl
Manifest | Bundle-Version | 1.2.7
pom | artifactid | axiom-impl
pom | description | The Axiom default implementation.
pom | groupid | apache.ws.commons.axiom
pom | name | Axiom Impl
pom | parent-artifactid | axiom
pom | parent-groupid | org.apache.ws.commons.axiom
pom | version | 1.2.7

#### Identifiers

- maven: org.apache.ws.commons.axiom:axiom-impl:1.2.7 Confidence:HIGHEST

### axis-1.4.jar

Description: An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axis-1.4.jar
MD5: 03dcfdd88502505cc5a805a128bfdd8d
SHA1: 94a9ce681a42d0352b3ad22659f67835e560d107

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | axis
central | groupid | axis
central | groupid | org.apache.axis
central | version | 1.4
file | name | axis
file | version | 1.4
jar | package name | apache
jar | package name | axis
manifest: org/apache/axis | Implementation-Title | Apache Axis
manifest: org/apache/axis | Implementation-Vendor | Apache Web Services
manifest: org/apache/axis | Implementation-Version | 1.4 1855 April 22 2006
pom | artifactid | axis
pom | description | An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.
pom | groupid | axis
pom | name | Axis Web Services
pom | url | http://ws.apache.org/axis
pom | version | 1.4

#### Identifiers

- maven: axis:axis:1.4 Confidence:HIGHEST
- cpe: cpe:/a:apache:axis:1.4 Confidence:HIGHEST
- maven: org.apache.axis:axis:1.4 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2014-3596

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

- BID - 69295
- MISC - https://issues.apache.org/jira/browse/AXIS-2905
- MLIST - [oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack
- REDHAT - RHSA-2014:1193
- SECTRACK - 1030745
- XF - apache-axis-cve20143596-spoofing(95377)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:axis:1.4 and all previous versions
- ...
- cpe:/a:apache:axis:1.0
- cpe:/a:apache:axis:1.0:beta
- cpe:/a:apache:axis:1.0:rc1
- cpe:/a:apache:axis:1.0:rc2
- cpe:/a:apache:axis:1.1
- cpe:/a:apache:axis:1.1:beta
- cpe:/a:apache:axis:1.1:rc1
- cpe:/a:apache:axis:1.1:rc2
- cpe:/a:apache:axis:1.2
- cpe:/a:apache:axis:1.2:alpha
- cpe:/a:apache:axis:1.2:beta1
- cpe:/a:apache:axis:1.2:beta2
- cpe:/a:apache:axis:1.2:beta3
- cpe:/a:apache:axis:1.2:rc1
- cpe:/a:apache:axis:1.2:rc2
- cpe:/a:apache:axis:1.2:rc3
- cpe:/a:apache:axis:1.2.1
- cpe:/a:apache:axis:1.3
- cpe:/a:apache:axis:1.4 and all previous versions

CVE-2012-5784

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-20 Improper Input Validation

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

- BID - 56408
- MISC - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
- REDHAT - RHSA-2013:0269
- REDHAT - RHSA-2013:0683
- REDHAT - RHSA-2014:0037
- SECUNIA - 51219
- XF - apache-axis-ssl-spoofing(79829)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:axis:1.4 and all previous versions
- ...
- cpe:/a:apache:activemq:-
- cpe:/a:apache:axis:-:alpha1
- cpe:/a:apache:axis:-:alpha2
- cpe:/a:apache:axis:-:alpha3
- cpe:/a:apache:axis:-:beta1
- cpe:/a:apache:axis:-:beta2
- cpe:/a:apache:axis:-:beta3
- cpe:/a:apache:axis:1.0
- cpe:/a:apache:axis:1.0:beta
- cpe:/a:apache:axis:1.0:rc1
- cpe:/a:apache:axis:1.0:rc2
- cpe:/a:apache:axis:1.1
- cpe:/a:apache:axis:1.1:beta
- cpe:/a:apache:axis:1.1:rc1
- cpe:/a:apache:axis:1.1:rc2
- cpe:/a:apache:axis:1.2
- cpe:/a:apache:axis:1.2:alpha
- cpe:/a:apache:axis:1.2:beta1
- cpe:/a:apache:axis:1.2:beta2
- cpe:/a:apache:axis:1.2:beta3
- cpe:/a:apache:axis:1.2:rc1
- cpe:/a:apache:axis:1.2:rc2
- cpe:/a:apache:axis:1.2:rc3
- cpe:/a:apache:axis:1.2.1
- cpe:/a:apache:axis:1.3
- cpe:/a:apache:axis:1.4 and all previous versions
- cpe:/a:paypal:mass_pay:-
- cpe:/a:paypal:payments_pro:-
- cpe:/a:paypal:transactional_information_soap:-

### axis2-kernel-1.4.1.jar

Description: Core Parts of Axis 2.0. This includes Axis 2.0 engine, Client API, Addressing support, etc.,

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axis2-kernel-1.4.1.jar
MD5: f5f5255626be01918cece10d14f937df
SHA1: fd59331a4bbc734c290744316e627ea343329f49

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | axis2-kernel
central | groupid | org.apache.axis2
central | version | 1.4.1
file | name | axis2-kernel
file | version | 1.4.1
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Axis2 Kernel
Manifest | bundle-symbolicname | org.apache.axis2.kernel
Manifest | Bundle-Version | 1.4
pom | artifactid | axis2-kernel
pom | description | Core Parts of Axis 2.0. This includes Axis 2.0 engine, Client API, Addressing support, etc.,
pom | groupid | apache.axis2
pom | name | Apache Axis2 - Kernel
pom | parent-artifactid | axis2-parent
pom | parent-groupid | org.apache.axis2
pom | version | 1.4.1

#### Related Dependencies

- axis2-adb-1.4.1.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axis2-adb-1.4.1.jar
  - SHA1: 800c809fde5746d679e4083d64b3c6f4cb95f74b
  - MD5: e29969fdd0dfdc361a9e116a9ad49c43
  - maven: org.apache.axis2:axis2-adb:1.4.1
- axis2-spring-1.4.1.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\axis2-spring-1.4.1.jar
  - SHA1: c9d1a9a7bcb5665c4b3e5224be95e353f8285912
  - MD5: 561ae3fc450359077da8c54bdd081c1b
  - maven: org.apache.axis2:axis2-spring:1.4.1

#### Identifiers

- cpe: cpe:/a:apache:axis2:1.4.1 Confidence:HIGHEST
- maven: org.apache.axis2:axis2-kernel:1.4.1 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2012-5785

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-20 Improper Input Validation

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

- BID - 56408
- MISC - http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
- SECUNIA - 51219
- XF - apache-axis2-ssl-spoofing(79830)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:axis2:1.6.2 and all previous versions
- ...
- cpe:/a:apache:axis2:1.5.1
- cpe:/a:apache:axis2:1.5.2
- cpe:/a:apache:axis2:1.5.3
- cpe:/a:apache:axis2:1.5.4
- cpe:/a:apache:axis2:1.5.5
- cpe:/a:apache:axis2:1.5.6
- cpe:/a:apache:axis2:1.6
- cpe:/a:apache:axis2:1.6.1
- cpe:/a:apache:axis2:1.6.2 and all previous versions

CVE-2012-5351

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

- MISC - http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
- XF - apache-axis2-saml-sec-bypass(79487)

Vulnerable Software & Versions:

- cpe:/a:apache:axis2:-

CVE-2012-4418

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

- BID - 55508
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=856755
- MISC - http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
- MLIST - [oss-security] 20120912 CVE Request: Apache Axis2 XML Signature Wrapping Attack
- MLIST - [oss-security] 20120912 Re: CVE Request: Apache Axis2 XML Signature Wrapping Attack

Vulnerable Software & Versions:

- cpe:/a:apache:axis2:-

CVE-2010-2103

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.

- BID - 40327
- BUGTRAQ - 20100521 PR10-03: Authenticated Cross-Site Scripting (XSS) within the Apache Axis2 administration console
- CONFIRM - https://kb.juniper.net/KB27373
- EXPLOIT-DB - 12689
- MISC - http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf
- MISC - http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03
- OSVDB - 64844
- SECUNIA - 39906
- VUPEN - ADV-2010-1215
- XF - axis2-modules-xss(58790)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:axis2:1.4.1
- ...
- cpe:/a:apache:axis2:1.4.1
- cpe:/a:apache:axis2:1.5.1

CVE-2010-1632

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.

- CONFIRM - http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
- CONFIRM - http://geronimo.apache.org/21x-security-report.html
- CONFIRM - http://geronimo.apache.org/22x-security-report.html
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21433581
- CONFIRM - https://issues.apache.org/jira/browse/AXIS2-4450
- CONFIRM - https://issues.apache.org/jira/browse/GERONIMO-5383
- CONFIRM - https://svn.apache.org/repos/asf/axis/axis2/java/core/security/CVE-2010-1632.pdf
- MISC - http://markmail.org/message/e4yiij7lfexastvl
- SECUNIA - 40252
- SECUNIA - 40279
- SECUNIA - 41016
- SECUNIA - 41025
- VUPEN - ADV-2010-1528
- VUPEN - ADV-2010-1531

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:axis2:1.4.1
- ...
- cpe:/a:apache:axis2:1.3
- cpe:/a:apache:axis2:1.4
- cpe:/a:apache:axis2:1.4.1
- cpe:/a:apache:axis2:1.5
- cpe:/a:apache:axis2:1.5.1 and all previous versions

CVE-2010-0219

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-255 Credentials Management

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.

- BUGTRAQ - 20101014 R7-0037: SAP BusinessObjects Axis2 Default Admin Password
- CERT-VN - VU#989719
- CONFIRM - https://kb.juniper.net/KB27373
- EXPLOIT-DB - 15869
- MISC - http://retrogod.altervista.org/9sg_ca_d2d.html
- MISC - http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf
- MISC - http://www.rapid7.com/security-center/advisories/R7-0037.jsp
- MISC - https://service.sap.com/sap/support/notes/1432881
- OSVDB - 70233
- SECTRACK - 1024929
- SECUNIA - 41799
- SECUNIA - 42763
- VUPEN - ADV-2010-2673
- XF - businessobjects-dswsbobje-security-bypass(62523)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:axis2:1.4.1
- ...
- cpe:/a:apache:axis2:1.3
- cpe:/a:apache:axis2:1.4
- cpe:/a:apache:axis2:1.4.1
- cpe:/a:apache:axis2:1.5
- cpe:/a:apache:axis2:1.5.1
- cpe:/a:apache:axis2:1.5.2
- cpe:/a:apache:axis2:1.6
- cpe:/a:sap:businessobjects:3.2::enterprise_xi

### backport-util-concurrent-3.1.jar

Description: Dawid Kurzyniec's backport of JSR 166

License:

    Public Domain: http://creativecommons.org/licenses/publicdomain

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\backport-util-concurrent-3.1.jar
MD5: 748bb0cbf4780b2e3121dc9c12e10cd9
SHA1: 682f7ac17fed79e92f8e87d8455192b63376347b

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | backport-util-concurrent
central | groupid | backport-util-concurrent
central | version | 3.1
file | name | backport-util-concurrent
file | version | 3.1
jar | package name | backport
jar | package name | edu
jar | package name | emory
jar | package name | mathcs
pom | artifactid | backport-util-concurrent
pom | description | Dawid Kurzyniec's backport of JSR 166
pom | groupid | backport-util-concurrent
pom | name | Backport of JSR 166
pom | organization name | http://www.mathcs.emory.edu/~dawidk/
pom | url | http://backport-jsr166.sourceforge.net/
pom | version | 3.1

#### Identifiers

- maven: backport-util-concurrent:backport-util-concurrent:3.1 Confidence:HIGHEST

### bootable-0.1.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\bootable-0.1.0.jar
MD5: 22d05d41c7d7174a1166802d5cb34a01
SHA1: f8801c5780e56c6b7e86b3a729b0f4003225dae7

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | bootable
file | version | 0.1.0
Manifest | spring-boot-version | 1.3.5.RELEASE
pom | artifactid | bootable
pom | groupid | owasp.testing
pom | name | bootable
pom | parent-artifactid | fully-executable
pom | parent-groupid | org.owasp.testing
pom | version | 0.1.0

#### Identifiers

- maven: org.owasp.testing:bootable:0.1.0 Confidence:HIGH

### bootable-0.1.0.jar: lib-0.1.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\bootable-0.1.0.jar\lib\lib-0.1.0.jar
MD5: 877e0eb39e3c985e2c1d553bb6dad934
SHA1: 13af17492135898d8ebced6cfe7aa3b9914ddeaa

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | lib
file | version | 0.1.0
jar | package name | lib
jar | package name | owasp
pom | artifactid | lib
pom | groupid | owasp.testing
pom | name | lib
pom | parent-artifactid | fully-executable
pom | parent-groupid | org.owasp.testing
pom | version | 0.1.0

#### Identifiers

- maven: org.owasp.testing:lib:0.1.0 Confidence:HIGH

### ffmpeg\ffmpeg_version.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\3rdparty\ffmpeg\ffmpeg_version.cmake
MD5: 47c336385aec534dee9a316f3ac04773
SHA1: 81feb6f931f727482b71b2e34f325387f46ad09b

#### Evidence

Source | Name | Value
--- | --- | ---
ffmpeg\ffmpeg_version.cmake | Product | libavcodec
ffmpeg\ffmpeg_version.cmake | Version | 55.18.102
file | name | ffmpeg_version

#### Identifiers

- cpe: cpe:/a:ffmpeg:ffmpeg:55.18.102 Confidence:LOW

#### Published Vulnerabilities

CVE-2011-4031

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors

Integer underflow in the asfrtp_parse_packet function in libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers to execute arbitrary code via a crafted ASF packet.

- CONFIRM - http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c2a2ad133eb9d42361804a568dee336992349a5e
- CONFIRM - http://git.videolan.org/?p=ffmpeg.git;a=shortlog;h=n0.8.3
- MISC - http://technet.microsoft.com/en-us/security/msvr/msvr11-012

Vulnerable Software & Versions: (show all)

- cpe:/a:ffmpeg:ffmpeg
- ...
- cpe:/a:ffmpeg:ffmpeg
- cpe:/a:ffmpeg:ffmpeg:0.3
- cpe:/a:ffmpeg:ffmpeg:0.3.1
- cpe:/a:ffmpeg:ffmpeg:0.3.2
- cpe:/a:ffmpeg:ffmpeg:0.3.3
- cpe:/a:ffmpeg:ffmpeg:0.3.4
- cpe:/a:ffmpeg:ffmpeg:0.4.0
- cpe:/a:ffmpeg:ffmpeg:0.4.2
- cpe:/a:ffmpeg:ffmpeg:0.4.3
- cpe:/a:ffmpeg:ffmpeg:0.4.4
- cpe:/a:ffmpeg:ffmpeg:0.4.5
- cpe:/a:ffmpeg:ffmpeg:0.4.6
- cpe:/a:ffmpeg:ffmpeg:0.4.7
- cpe:/a:ffmpeg:ffmpeg:0.4.8
- cpe:/a:ffmpeg:ffmpeg:0.4.9:pre1
- cpe:/a:ffmpeg:ffmpeg:0.4.9_pre1
- cpe:/a:ffmpeg:ffmpeg:0.5
- cpe:/a:ffmpeg:ffmpeg:0.5.1
- cpe:/a:ffmpeg:ffmpeg:0.5.2
- cpe:/a:ffmpeg:ffmpeg:0.5.3
- cpe:/a:ffmpeg:ffmpeg:0.5.4
- cpe:/a:ffmpeg:ffmpeg:0.6
- cpe:/a:ffmpeg:ffmpeg:0.6.1
- cpe:/a:ffmpeg:ffmpeg:0.6.2
- cpe:/a:ffmpeg:ffmpeg:0.7.1
- cpe:/a:ffmpeg:ffmpeg:0.7.2
- cpe:/a:ffmpeg:ffmpeg:0.7.3
- cpe:/a:ffmpeg:ffmpeg:0.8.0
- cpe:/a:ffmpeg:ffmpeg:0.8.1
- cpe:/a:ffmpeg:ffmpeg:0.8.2 and all previous versions

CVE-2009-0385

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors

Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.

- BID - 33502
- BUGTRAQ - 20090128 [TKADV2009-004] FFmpeg Type Conversion Vulnerability
- CONFIRM - http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17
- CONFIRM - http://svn.mplayerhq.hu/ffmpeg/trunk/libavformat/4xm.c?r1=16838&r2=16846&pathrev=16846
- CONFIRM - http://svn.mplayerhq.hu/ffmpeg?view=rev&revision=16846
- DEBIAN - DSA-1781
- DEBIAN - DSA-1782
- FEDORA - FEDORA-2009-3428
- FEDORA - FEDORA-2009-3433
- GENTOO - GLSA-200903-33
- MANDRIVA - MDVSA-2009:297
- MISC - http://www.trapkit.de/advisories/TKADV2009-004.txt
- OSVDB - 51643
- SECUNIA - 33711
- SECUNIA - 34296
- SECUNIA - 34385
- SECUNIA - 34712
- SECUNIA - 34845
- SECUNIA - 34905
- UBUNTU - USN-734-1
- VUPEN - ADV-2009-0277
- XF - ffmpeg-fourxmreadheader-code-execution(48330)

Vulnerable Software & Versions:

- cpe:/a:ffmpeg:ffmpeg

CVE-2005-4048

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.

- BID - 15743
- CONFIRM - http://cvs.freedesktop.org/gstreamer/gst-ffmpeg/ChangeLog?rev=1.239&view=markup
- CONFIRM - http://www1.mplayerhq.hu/cgi-bin/cvsweb.cgi/ffmpeg/libavcodec/utils.c.diff?r1=1.161&r2=1.162&cvsroot=FFMpeg
- CONFIRM - http://www1.mplayerhq.hu/cgi-bin/cvsweb.cgi/ffmpeg/libavcodec/utils.c?rev=1.162&content-type=text/x-cvsweb-markup&cvsroot=FFMpeg
- DEBIAN - DSA-1004
- DEBIAN - DSA-1005
- DEBIAN - DSA-992
- GENTOO - GLSA-200601-06
- GENTOO - GLSA-200602-01
- GENTOO - GLSA-200603-03
- MANDRIVA - MDKSA-2005:228
- MANDRIVA - MDKSA-2005:229
- MANDRIVA - MDKSA-2005:230
- MANDRIVA - MDKSA-2005:231
- MANDRIVA - MDKSA-2005:232
- MISC - http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558
- SECUNIA - 17892
- SECUNIA - 18066
- SECUNIA - 18087
- SECUNIA - 18107
- SECUNIA - 18400
- SECUNIA - 18739
- SECUNIA - 18746
- SECUNIA - 19114
- SECUNIA - 19192
- SECUNIA - 19272
- SECUNIA - 19279
- UBUNTU - USN-230-1
- UBUNTU - USN-230-2
- VUPEN - ADV-2005-2770

Vulnerable Software & Versions: (show all)

- cpe:/a:ffmpeg:ffmpeg:cvs
- ...
- cpe:/a:ffmpeg:ffmpeg:0.4.6
- cpe:/a:ffmpeg:ffmpeg:0.4.7
- cpe:/a:ffmpeg:ffmpeg:0.4.8
- cpe:/a:ffmpeg:ffmpeg:0.4.9_pre1
- cpe:/a:ffmpeg:ffmpeg:cvs

### cmake\cl2cpp.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\cl2cpp.cmake
MD5: 39ac6f35af7d4dd3ac3d75c06afe0613
SHA1: 1113347fe96d7d514c9f0bf711b96b352808dd0a

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | cl2cpp
file | version | 2

#### Identifiers

- None

### cmake\copyAndroidLibs.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\copyAndroidLibs.cmake
MD5: 6cea8a766548a7db3855ccec5627271d
SHA1: 8c9e2de7b35767238467548af3e05166e39edf4f

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | copyAndroidLibs

#### Identifiers

- None

### cmake\FindCUDA.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA.cmake
MD5: 082b257f892af1049627ab591e88ad5e
SHA1: 30b72858802f64c3e5331b6ec70e59dbad58673a

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | FindCUDA

#### Identifiers

- None

### FindCUDA\make2cmake.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA\make2cmake.cmake
MD5: 5a3c246f2fc21437ba265fa979b160d8
SHA1: 43d5d598c58f5f140d162975a92d2730806cce3f

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | make2cmake
file | version | 2

#### Identifiers

- None

### FindCUDA\parse_cubin.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA\parse_cubin.cmake
MD5: 5e5fb166c6c93c04621796f04189d0d7
SHA1: 3ecad79fcfe7c5d88a1535d1030026e1fcb2fce0

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | parse_cubin

#### Identifiers

- None

### FindCUDA\run_nvcc.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\FindCUDA\run_nvcc.cmake
MD5: d6160a6dcaaec3e526bc34cfcea2ee23
SHA1: 0349f1a43fbd380b0c7b578ae3242a7cb6d43cae

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | run_nvcc

#### Identifiers

- None

### cmake\OpenCVCompilerOptions.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVCompilerOptions.cmake
MD5: b40df1c984b511841c40d05a907d433d
SHA1: 30589febdc497eb330eb932a6a1f10197b362fb4

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVCompilerOptions

#### Identifiers

- None

### cmake\OpenCVConfig.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVConfig.cmake
MD5: f1f68ff13813a495470c6e73cc9b892a
SHA1: ad85337bb1ccac4a1261f6dda6ad1efcbce8b19d

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVConfig

#### Identifiers

- None

### cmake\OpenCVCRTLinkage.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVCRTLinkage.cmake
MD5: 7f8dcbf9848068f53e352679c0859cd5
SHA1: 25bcb6542245cf8497b467a1363fdf6adeaa67e2

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVCRTLinkage

#### Identifiers

- None

### cmake\OpenCVDetectAndroidSDK.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectAndroidSDK.cmake
MD5: bd17bbe3d290b31f39ca4f7876baf725
SHA1: c72e36dd3a7e6b933595c0724a2ce47a9d0fc45e

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectAndroidSDK

#### Identifiers

- cpe: cpe:/a:android:android_sdk:- Confidence:LOW

### cmake\OpenCVDetectApacheAnt.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectApacheAnt.cmake
MD5: c94b15ca35aec95bb1bdc6a8eec5ede1
SHA1: 33e018cfb004b30a5bd9c58e613172c36d74af41

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectApacheAnt

#### Identifiers

- None

### cmake\OpenCVDetectCStripes.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectCStripes.cmake
MD5: b7be59d929d4daf4ff6e367cd413f795
SHA1: a9e20a51d1d50603da768ab3fd7b6fdc03257370

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectCStripes

#### Identifiers

- None

### cmake\OpenCVDetectCUDA.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectCUDA.cmake
MD5: e8acb70a35eafaf93531804da5b3e827
SHA1: ca9162fe9849f5ebe84e14fc0ac6ea2a864da811

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectCUDA

#### Identifiers

- None

### cmake\OpenCVDetectCXXCompiler.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectCXXCompiler.cmake
MD5: d57d4cab100ce6d86a2abcf43895759d
SHA1: 1ed30817b5b2dd7c02d832ba95654ae120175715

#### Evidence

Source | Name | Value
--- | --- | ---
cmake\OpenCVDetectCXXCompiler.cmake | Product | CMAKE_GCC_REGEX
cmake\OpenCVDetectCXXCompiler.cmake | Version | 4.2.1
file | name | OpenCVDetectCXXCompiler

#### Identifiers

- None

### cmake\OpenCVDetectDirectX.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectDirectX.cmake
MD5: 30652d429f0a8562c7e8856517c4514d
SHA1: ce1afeafae26f37681b1a5ac698723e9d098dcff

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectDirectX

#### Identifiers

- None

### cmake\OpenCVDetectOpenCL.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectOpenCL.cmake
MD5: 7420a52a371cea66b93e2067c70b7f38
SHA1: 7d318b5bf007a532d3adc8f1c6978fdb365fa2c5

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectOpenCL

#### Identifiers

- None

### cmake\OpenCVDetectPython.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectPython.cmake
MD5: 5be7cd9ed88517f1017de27b8eb3228c
SHA1: 9bc4060369dbf9e7ece57639db81488115c84e13

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectPython

#### Identifiers

- cpe: cpe:/a:python:python:- Confidence:LOW

#### Published Vulnerabilities

CVE-2016-5699

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- CONFIRM - https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4
- CONFIRM - https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS
- CONFIRM - https://hg.python.org/cpython/rev/1c45047c5102
- CONFIRM - https://hg.python.org/cpython/rev/bf3e1c9b80e9
- MISC - http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
- MLIST - [oss-security] 20160614 CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- MLIST - [oss-security] 20160615 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
- MLIST - [oss-security] 20160616 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.7.9 and all previous versions
- ...
- cpe:/a:python:python:2.7.9 and all previous versions
- cpe:/a:python:python:3.0
- cpe:/a:python:python:3.0.1
- cpe:/a:python:python:3.1.0
- cpe:/a:python:python:3.1.1
- cpe:/a:python:python:3.1.2
- cpe:/a:python:python:3.1.3
- cpe:/a:python:python:3.1.4
- cpe:/a:python:python:3.1.5
- cpe:/a:python:python:3.2.0
- cpe:/a:python:python:3.2.1
- cpe:/a:python:python:3.2.2
- cpe:/a:python:python:3.2.3
- cpe:/a:python:python:3.2.4
- cpe:/a:python:python:3.2.5
- cpe:/a:python:python:3.2.6
- cpe:/a:python:python:3.3.0
- cpe:/a:python:python:3.3.1
- cpe:/a:python:python:3.3.2
- cpe:/a:python:python:3.3.3
- cpe:/a:python:python:3.3.4
- cpe:/a:python:python:3.3.5
- cpe:/a:python:python:3.3.6
- cpe:/a:python:python:3.4.0
- cpe:/a:python:python:3.4.1
- cpe:/a:python:python:3.4.2
- cpe:/a:python:python:3.4.3

CVE-2016-5636

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-190 Integer Overflow or Wraparound

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- CONFIRM - https://bugs.python.org/issue26171
- CONFIRM - https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
- CONFIRM - https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
- CONFIRM - https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
- MLIST - [oss-security] 20160615 CVE Request: heap overflow in Python zipimport module
- MLIST - [oss-security] 20160616 Re: CVE Request: heap overflow in Python zipimport module

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.7.11 and all previous versions
- ...
- cpe:/a:python:python:2.7.11 and all previous versions
- cpe:/a:python:python:3.0
- cpe:/a:python:python:3.0.1
- cpe:/a:python:python:3.1.0
- cpe:/a:python:python:3.1.1
- cpe:/a:python:python:3.1.2
- cpe:/a:python:python:3.1.3
- cpe:/a:python:python:3.1.4
- cpe:/a:python:python:3.1.5
- cpe:/a:python:python:3.2.0
- cpe:/a:python:python:3.2.1
- cpe:/a:python:python:3.2.2
- cpe:/a:python:python:3.2.3
- cpe:/a:python:python:3.2.4
- cpe:/a:python:python:3.2.5
- cpe:/a:python:python:3.2.6
- cpe:/a:python:python:3.3.0
- cpe:/a:python:python:3.3.1
- cpe:/a:python:python:3.3.2
- cpe:/a:python:python:3.3.3
- cpe:/a:python:python:3.3.4
- cpe:/a:python:python:3.3.5
- cpe:/a:python:python:3.3.6
- cpe:/a:python:python:3.4.0
- cpe:/a:python:python:3.4.1
- cpe:/a:python:python:3.4.2
- cpe:/a:python:python:3.4.3
- cpe:/a:python:python:3.4.4
- cpe:/a:python:python:3.5.0
- cpe:/a:python:python:3.5.1

CVE-2016-1494

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

- CONFIRM - https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by/diff
- MISC - https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/
- MLIST - [oss-security] 20160104 Re: CVE Request: python-rsa signature forgery
- MLIST - [oss-security] 20160105 CVE Request: python-rsa signature forgery

Vulnerable Software & Versions:

- cpe:/a:python:python:3.2.6 and all previous versions

CVE-2016-0772

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-693 Protection Mechanism Failure

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1303647
- CONFIRM - https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5
- CONFIRM - https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
- CONFIRM - https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS
- CONFIRM - https://hg.python.org/cpython/rev/b3ce713fb9be
- CONFIRM - https://hg.python.org/cpython/rev/d590114c2394
- MLIST - [oss-security] 20160614 Python CVE-2016-0772: smtplib StartTLS stripping attack

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.7.11 and all previous versions
- ...
- cpe:/a:python:python:2.7.11 and all previous versions
- cpe:/a:python:python:3.0
- cpe:/a:python:python:3.0.1
- cpe:/a:python:python:3.1.0
- cpe:/a:python:python:3.1.1
- cpe:/a:python:python:3.1.2
- cpe:/a:python:python:3.1.3
- cpe:/a:python:python:3.1.4
- cpe:/a:python:python:3.1.5
- cpe:/a:python:python:3.2.0
- cpe:/a:python:python:3.2.1
- cpe:/a:python:python:3.2.2
- cpe:/a:python:python:3.2.3
- cpe:/a:python:python:3.2.4
- cpe:/a:python:python:3.2.5
- cpe:/a:python:python:3.2.6
- cpe:/a:python:python:3.3.0
- cpe:/a:python:python:3.3.1
- cpe:/a:python:python:3.3.2
- cpe:/a:python:python:3.3.3
- cpe:/a:python:python:3.3.4
- cpe:/a:python:python:3.3.5
- cpe:/a:python:python:3.3.6
- cpe:/a:python:python:3.4.0
- cpe:/a:python:python:3.4.1
- cpe:/a:python:python:3.4.2
- cpe:/a:python:python:3.4.3
- cpe:/a:python:python:3.4.4
- cpe:/a:python:python:3.5.0
- cpe:/a:python:python:3.5.1

CVE-2015-5652

Severity: High
CVSS Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."

- JVN - JVN#49503705
- JVNDB - JVNDB-2015-000141
- MISC - http://jvn.jp/en/jp/JVN49503705/995204/index.html

Vulnerable Software & Versions:

- cpe:/a:python:python:3.5.0 and all previous versions

CVE-2014-7185

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CWE: CWE-189 Numeric Errors

Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.

- APPLE - APPLE-SA-2015-08-13-2
- BID - 70089
- CONFIRM - http://bugs.python.org/issue21831
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1146026
- CONFIRM - https://support.apple.com/kb/HT205031
- FEDORA - FEDORA-2014-11559
- MLIST - [oss-security] 20140923 CVE Request: Python 2.7
- MLIST - [oss-security] 20140925 Re: CVE Request: Python 2.7
- SUSE - openSUSE-SU-2014:1292
- XF - python-bufferobject-overflow(96193)

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.7.7 and all previous versions
- ...
- cpe:/a:apple:mac_os_x:10.10.4 and all previous versions
- cpe:/a:python:python:2.7
- cpe:/a:python:python:2.7.1
- cpe:/a:python:python:2.7.1:rc1
- cpe:/a:python:python:2.7.2:rc1
- cpe:/a:python:python:2.7.3
- cpe:/a:python:python:2.7.4
- cpe:/a:python:python:2.7.5
- cpe:/a:python:python:2.7.6
- cpe:/a:python:python:2.7.7 and all previous versions
- cpe:/a:python:python:2.7.1150
- cpe:/a:python:python:2.7.1150::~~~~x64~
- cpe:/a:python:python:2.7.2150

CVE-2013-7338

Severity: High
CVSS Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

- CONFIRM - http://bugs.python.org/issue20078
- CONFIRM - http://hg.python.org/cpython/rev/79ea4ce431b1
- CONFIRM - https://docs.python.org/3.3/whatsnew/changelog.html
- MLIST - [oss-security] 20140318 CVE request for python/zipfile
- MLIST - [oss-security] 20140319 Re: CVE request for python/zipfile
- SECTRACK - 1029973
- SUSE - openSUSE-SU-2014:0597

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:3.3.4:rc1 and all previous versions
- ...
- cpe:/a:python:python:3.3
- cpe:/a:python:python:3.3:beta2
- cpe:/a:python:python:3.3.0
- cpe:/a:python:python:3.3.1
- cpe:/a:python:python:3.3.1:rc1
- cpe:/a:python:python:3.3.2
- cpe:/a:python:python:3.3.3
- cpe:/a:python:python:3.3.3:rc1
- cpe:/a:python:python:3.3.3:rc2
- cpe:/a:python:python:3.3.4:rc1 and all previous versions

CVE-2012-1150

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-310 Cryptographic Issues

Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

- APPLE - APPLE-SA-2013-10-22-3
- CONFIRM - http://bugs.python.org/issue13703
- CONFIRM - http://python.org/download/releases/2.6.8/
- CONFIRM - http://python.org/download/releases/2.7.3/
- CONFIRM - http://python.org/download/releases/3.1.5/
- CONFIRM - http://python.org/download/releases/3.2.3/
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=750555
- MLIST - [oss-security] 20120309 Re: CVE Request: Python Hash DoS (Issue 13703)
- MLIST - [python-dev] 20111229 Hash collision security issue (now public)
- MLIST - [python-dev] 20120128 plugging the hash attack
- SECUNIA - 50858
- SECUNIA - 51087
- SECUNIA - 51089
- UBUNTU - USN-1592-1
- UBUNTU - USN-1596-1
- UBUNTU - USN-1615-1
- UBUNTU - USN-1616-1

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.6.7 and all previous versions
- ...
- cpe:/a:python:python:0.9.0
- cpe:/a:python:python:0.9.1
- cpe:/a:python:python:1.2
- cpe:/a:python:python:1.3
- cpe:/a:python:python:1.5.2
- cpe:/a:python:python:1.6
- cpe:/a:python:python:1.6.1
- cpe:/a:python:python:2.0
- cpe:/a:python:python:2.0.1
- cpe:/a:python:python:2.1
- cpe:/a:python:python:2.1.1
- cpe:/a:python:python:2.1.2
- cpe:/a:python:python:2.1.3
- cpe:/a:python:python:2.2
- cpe:/a:python:python:2.2.1
- cpe:/a:python:python:2.2.2
- cpe:/a:python:python:2.2.3
- cpe:/a:python:python:2.3
- cpe:/a:python:python:2.3.1
- cpe:/a:python:python:2.3.2
- cpe:/a:python:python:2.3.3
- cpe:/a:python:python:2.3.4
- cpe:/a:python:python:2.3.5
- cpe:/a:python:python:2.3.7
- cpe:/a:python:python:2.4
- cpe:/a:python:python:2.4.1
- cpe:/a:python:python:2.4.2
- cpe:/a:python:python:2.4.3
- cpe:/a:python:python:2.4.4
- cpe:/a:python:python:2.4.6
- cpe:/a:python:python:2.5
- cpe:/a:python:python:2.5.1
- cpe:/a:python:python:2.5.2
- cpe:/a:python:python:2.5.3
- cpe:/a:python:python:2.5.4
- cpe:/a:python:python:2.5.6
- cpe:/a:python:python:2.5.150
- cpe:/a:python:python:2.6
- cpe:/a:python:python:2.6.1
- cpe:/a:python:python:2.6.2
- cpe:/a:python:python:2.6.3
- cpe:/a:python:python:2.6.4
- cpe:/a:python:python:2.6.5
- cpe:/a:python:python:2.6.6
- cpe:/a:python:python:2.6.7 and all previous versions
- cpe:/a:python:python:2.6.2150
- cpe:/a:python:python:2.6.6150
- cpe:/a:python:python:2.7
- cpe:/a:python:python:2.7.1
- cpe:/a:python:python:2.7.1:rc1
- cpe:/a:python:python:2.7.2:rc1
- cpe:/a:python:python:2.7.1150
- cpe:/a:python:python:2.7.2150
- cpe:/a:python:python:3.0
- cpe:/a:python:python:3.0.1
- cpe:/a:python:python:3.1
- cpe:/a:python:python:3.1.1
- cpe:/a:python:python:3.1.2
- cpe:/a:python:python:3.1.3
- cpe:/a:python:python:3.1.4
- cpe:/a:python:python:3.2
- cpe:/a:python:python:3.2:alpha
- cpe:/a:python:python:3.2.2150

CVE-2012-0845

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.

- APPLE - APPLE-SA-2013-10-22-3
- CONFIRM - http://bugs.python.org/issue14001
- CONFIRM - http://python.org/download/releases/2.6.8/
- CONFIRM - http://python.org/download/releases/2.7.3/
- CONFIRM - http://python.org/download/releases/3.1.5/
- CONFIRM - http://python.org/download/releases/3.2.3/
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=789790
- MLIST - [oss-security] 20120213 Re: CVE Request -- python (SimpleXMLRPCServer): DoS (excessive CPU usage) via malformed XML-RPC / HTTP POST request
- SECTRACK - 1026689
- SECUNIA - 50858
- SECUNIA - 51024
- SECUNIA - 51040
- SECUNIA - 51087
- SECUNIA - 51089
- UBUNTU - USN-1592-1
- UBUNTU - USN-1596-1
- UBUNTU - USN-1613-1
- UBUNTU - USN-1613-2
- UBUNTU - USN-1615-1
- UBUNTU - USN-1616-1

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.6.7 and all previous versions
- ...
- cpe:/a:python:python:0.9.0
- cpe:/a:python:python:0.9.1
- cpe:/a:python:python:1.2
- cpe:/a:python:python:1.3
- cpe:/a:python:python:1.5.2
- cpe:/a:python:python:1.6
- cpe:/a:python:python:1.6.1
- cpe:/a:python:python:2.0
- cpe:/a:python:python:2.0.1
- cpe:/a:python:python:2.1
- cpe:/a:python:python:2.1.1
- cpe:/a:python:python:2.1.2
- cpe:/a:python:python:2.1.3
- cpe:/a:python:python:2.2
- cpe:/a:python:python:2.2.1
- cpe:/a:python:python:2.2.2
- cpe:/a:python:python:2.2.3
- cpe:/a:python:python:2.3
- cpe:/a:python:python:2.3.1
- cpe:/a:python:python:2.3.2
- cpe:/a:python:python:2.3.3
- cpe:/a:python:python:2.3.4
- cpe:/a:python:python:2.3.5
- cpe:/a:python:python:2.3.7
- cpe:/a:python:python:2.4
- cpe:/a:python:python:2.4.1
- cpe:/a:python:python:2.4.2
- cpe:/a:python:python:2.4.3
- cpe:/a:python:python:2.4.4
- cpe:/a:python:python:2.4.6
- cpe:/a:python:python:2.5
- cpe:/a:python:python:2.5.1
- cpe:/a:python:python:2.5.2
- cpe:/a:python:python:2.5.3
- cpe:/a:python:python:2.5.4
- cpe:/a:python:python:2.5.6
- cpe:/a:python:python:2.5.150
- cpe:/a:python:python:2.6
- cpe:/a:python:python:2.6.1
- cpe:/a:python:python:2.6.2
- cpe:/a:python:python:2.6.3
- cpe:/a:python:python:2.6.4
- cpe:/a:python:python:2.6.5
- cpe:/a:python:python:2.6.6
- cpe:/a:python:python:2.6.7 and all previous versions
- cpe:/a:python:python:2.6.2150
- cpe:/a:python:python:2.6.6150
- cpe:/a:python:python:2.7
- cpe:/a:python:python:2.7.1
- cpe:/a:python:python:2.7.1:rc1
- cpe:/a:python:python:2.7.2:rc1
- cpe:/a:python:python:2.7.1150
- cpe:/a:python:python:2.7.2150
- cpe:/a:python:python:3.0
- cpe:/a:python:python:3.0.1
- cpe:/a:python:python:3.1
- cpe:/a:python:python:3.1.1
- cpe:/a:python:python:3.1.2
- cpe:/a:python:python:3.1.3
- cpe:/a:python:python:3.1.4
- cpe:/a:python:python:3.2
- cpe:/a:python:python:3.2:alpha
- cpe:/a:python:python:3.2.2150

CVE-2011-4940

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

- BID - 54083
- CONFIRM - http://bugs.python.org/issue11442
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=803500
- JVN - JVN#51176027
- JVNDB - JVNDB-2012-000063
- SECUNIA - 50858
- SECUNIA - 51024
- SECUNIA - 51040
- UBUNTU - USN-1592-1
- UBUNTU - USN-1596-1
- UBUNTU - USN-1613-1
- UBUNTU - USN-1613-2

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:2.5.6 and all previous versions
- ...
- cpe:/a:python:python:0.9.0
- cpe:/a:python:python:0.9.1
- cpe:/a:python:python:1.2
- cpe:/a:python:python:1.3
- cpe:/a:python:python:1.5.2
- cpe:/a:python:python:1.6
- cpe:/a:python:python:1.6.1
- cpe:/a:python:python:2.0.1
- cpe:/a:python:python:2.1.1
- cpe:/a:python:python:2.1.2
- cpe:/a:python:python:2.1.3
- cpe:/a:python:python:2.2.1
- cpe:/a:python:python:2.2.2
- cpe:/a:python:python:2.2.3
- cpe:/a:python:python:2.3.1
- cpe:/a:python:python:2.3.2
- cpe:/a:python:python:2.3.3
- cpe:/a:python:python:2.3.4
- cpe:/a:python:python:2.3.5
- cpe:/a:python:python:2.3.7
- cpe:/a:python:python:2.4.1
- cpe:/a:python:python:2.4.2
- cpe:/a:python:python:2.4.3
- cpe:/a:python:python:2.4.4
- cpe:/a:python:python:2.4.6
- cpe:/a:python:python:2.5.1
- cpe:/a:python:python:2.5.2
- cpe:/a:python:python:2.5.3
- cpe:/a:python:python:2.5.4
- cpe:/a:python:python:2.5.6 and all previous versions
- cpe:/a:python:python:2.6.1
- cpe:/a:python:python:2.6.2
- cpe:/a:python:python:2.6.3
- cpe:/a:python:python:2.6.4
- cpe:/a:python:python:2.6.5
- cpe:/a:python:python:2.6.6
- cpe:/a:python:python:2.7
- cpe:/a:python:python:2.7.1
- cpe:/a:python:python:2.7.1:rc1
- cpe:/a:python:python:2.7.2:rc1

CVE-2010-3492

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.

- CONFIRM - http://bugs.python.org/issue6706
- MANDRIVA - MDVSA-2010:215
- MANDRIVA - MDVSA-2010:216
- MLIST - [oss-security] 20100909 CVE Request -- Python -- accept() implementation in async core is broken => more subcases
- MLIST - [oss-security] 20100910 Re: CVE Request -- Python -- accept() implementation in async core is broken => more subcases
- MLIST - [oss-security] 20100922 Re: CVE Request -- Python -- accept() implementation in async core is broken => more subcases
- MLIST - [oss-security] 20100924 Re: CVE Request -- Python -- accept() implementation in async core is broken => more subcases

Vulnerable Software & Versions: (show all)

- cpe:/a:python:python:3.1.2 and all previous versions
- ...
- cpe:/a:python:python:0.9.0
- cpe:/a:python:python:0.9.1
- cpe:/a:python:python:1.2
- cpe:/a:python:python:1.3
- cpe:/a:python:python:1.5.2
- cpe:/a:python:python:1.6
- cpe:/a:python:python:1.6.1
- cpe:/a:python:python:2.0
- cpe:/a:python:python:2.0.1
- cpe:/a:python:python:2.1
- cpe:/a:python:python:2.1.1
- cpe:/a:python:python:2.1.2
- cpe:/a:python:python:2.1.3
- cpe:/a:python:python:2.2
- cpe:/a:python:python:2.2.1
- cpe:/a:python:python:2.2.2
- cpe:/a:python:python:2.2.3
- cpe:/a:python:python:2.3
- cpe:/a:python:python:2.3.1
- cpe:/a:python:python:2.3.2
- cpe:/a:python:python:2.3.3
- cpe:/a:python:python:2.3.4
- cpe:/a:python:python:2.3.5
- cpe:/a:python:python:2.3.7
- cpe:/a:python:python:2.4
- cpe:/a:python:python:2.4.1
- cpe:/a:python:python:2.4.2
- cpe:/a:python:python:2.4.3
- cpe:/a:python:python:2.4.4
- cpe:/a:python:python:2.4.6
- cpe:/a:python:python:2.5
- cpe:/a:python:python:2.5.1
- cpe:/a:python:python:2.5.2
- cpe:/a:python:python:2.5.3
- cpe:/a:python:python:2.5.4
- cpe:/a:python:python:2.6
- cpe:/a:python:python:2.6.1
- cpe:/a:python:python:2.6.4
- cpe:/a:python:python:2.7
- cpe:/a:python:python:3.0
- cpe:/a:python:python:3.0.1
- cpe:/a:python:python:3.1.1
- cpe:/a:python:python:3.1.2 and all previous versions

### cmake\OpenCVDetectTBB.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectTBB.cmake
MD5: 35189457dc179a836ad4484994d5976d
SHA1: 40ea5f223fe4deb3713b3f3d2e16e6e1b6772617

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectTBB

#### Identifiers

- None

### cmake\OpenCVDetectVTK.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVDetectVTK.cmake
MD5: c134da83c26ab7a2da167d844c79ad03
SHA1: 47fe39d954f02e6ece66d6b30294798c2d1057bf

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVDetectVTK

#### Identifiers

- None

### cmake\OpenCVExtraTargets.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVExtraTargets.cmake
MD5: 300f1984f05136a2550662b4bba28484
SHA1: f9df6c52285f609bc449e0d264cec3ba4d33495c

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVExtraTargets

#### Identifiers

- None

### cmake\OpenCVFindIntelPerCSDK.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindIntelPerCSDK.cmake
MD5: 4a8839ddf7a69626978b6f51d8148ba8
SHA1: a0c46db81c0ccadc5c0d4d8d1b28c506836e3dc5

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindIntelPerCSDK

#### Identifiers

- None

### cmake\OpenCVFindIPP.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindIPP.cmake
MD5: 1b0e6265a662426ed5ee3a8eae3571f1
SHA1: 1bffb60918a63d6865165cb47e53d08971bfdb3e

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindIPP

#### Identifiers

- None

### cmake\OpenCVFindIPPAsync.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindIPPAsync.cmake
MD5: 9053f0d6f31a969eaa1fc6ae03d72b45
SHA1: 0487f605adcfaabf4c4d2898691c3c453c6cd98d

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindIPPAsync

#### Identifiers

- None

### cmake\OpenCVFindLATEX.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLATEX.cmake
MD5: c048924d7b99ee46b0ad194b0e9236a2
SHA1: 59493c4b35f9772e5f46b8195804b73bc0b8cd68

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindLATEX

#### Identifiers

- None

### cmake\OpenCVFindLibsGrfmt.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsGrfmt.cmake
MD5: 471c89912ae29f34ce3d8951bfaba775
SHA1: e41b7bd06b878254fba925fd6d5d97e8f7e4abdd

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindLibsGrfmt

#### Identifiers

- None

### cmake\OpenCVFindLibsGUI.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsGUI.cmake
MD5: c744b1958188a1418eab4eb8f295631a
SHA1: e4791e1c486531692bc0aa07ee144276ff957b17

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindLibsGUI

#### Identifiers

- None

### cmake\OpenCVFindLibsPerf.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsPerf.cmake
MD5: 10f99115bf875881b2802eabd746a628
SHA1: 1ebfda9512e60f2f75ec491b17c3b2bf3649980d

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindLibsPerf

#### Identifiers

- None

### cmake\OpenCVFindLibsVideo.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindLibsVideo.cmake
MD5: 4d81f6af4a31bd51dee812e87617219d
SHA1: 979689596b9e86b846f514d87e56bf87895c1279

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindLibsVideo

#### Identifiers

- None

### cmake\OpenCVFindMatlab.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindMatlab.cmake
MD5: 9f8df03241c51e2003d1bcfe9f99949d
SHA1: 895e96702c15ae75ed3a9904762104e8e67c9349

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindMatlab

#### Identifiers

- None

### cmake\OpenCVFindOpenEXR.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindOpenEXR.cmake
MD5: c596e3648c5aed16362c90abf1a69885
SHA1: 91cd4c5d5cd98d1990f23dfd8a52de7525fe2636

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindOpenEXR

#### Identifiers

- cpe: cpe:/a:openexr:openexr:- Confidence:LOW

### cmake\OpenCVFindOpenNI.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindOpenNI.cmake
MD5: 98bcd2f11e0793e231abd8a3ffb32faa
SHA1: b7274cea06a5973a42553d6b4b9ff428785f6d48

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindOpenNI

#### Identifiers

- None

### cmake\OpenCVFindOpenNI2.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindOpenNI2.cmake
MD5: 1409780229828db7219727ad64db1f6e
SHA1: daa97eb9f5072aa4bc951eda2a921fc35d2eac2b

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindOpenNI2
file | version | 2

#### Identifiers

- None

### cmake\OpenCVFindWebP.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindWebP.cmake
MD5: 02b64eac70bf1852a0be5fda17c92e11
SHA1: 949fb1bd9eeebf9b55eeaa3a8f4d95a450c47b13

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindWebP

#### Identifiers

- None

### cmake\OpenCVFindXimea.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVFindXimea.cmake
MD5: b65b6afa478b612f1ab8f4486b3ba791
SHA1: f8cf6b2baa915d9488062a317f2c6e473ad96ef1

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVFindXimea

#### Identifiers

- None

### cmake\OpenCVGenABI.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenABI.cmake
MD5: dab62ee8b994fba211e1877c88dcb7ae
SHA1: d01fed523caff4a3be0c0b0062e7a192f0b3e592

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVGenABI

#### Identifiers

- None

### cmake\OpenCVGenAndroidMK.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenAndroidMK.cmake
MD5: 9523098110ae460e82b9d5e44ad4c7ad
SHA1: 63024b62e8b39fa23658b8ec10830d94b72587d9

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVGenAndroidMK

#### Identifiers

- None

### cmake\OpenCVGenConfig.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenConfig.cmake
MD5: a2ab87729d247b60a7c4aaedd9a9389d
SHA1: 0bdf47a9c04ac44f62d8cf7806640bf8be9825b2

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVGenConfig

#### Identifiers

- None

### cmake\OpenCVGenHeaders.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenHeaders.cmake
MD5: 5a7d0877b8f16a4f5c62757a0051dcc5
SHA1: d7cfe5e707b00ec2e79d6aef77b339ea3c7b2f17

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVGenHeaders

#### Identifiers

- None

### cmake\OpenCVGenInfoPlist.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenInfoPlist.cmake
MD5: ce0875d872f99c9ef28d52a8f59a85f2
SHA1: 313376669a28af75d25ab8b735132550a4f3052e

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVGenInfoPlist

#### Identifiers

- None

### cmake\OpenCVGenPkgconfig.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVGenPkgconfig.cmake
MD5: 61f497e15c639f7231c0657cf51202fd
SHA1: d2e5ea3b8a68485bbac4a205c7a68217ed66e779

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVGenPkgconfig

#### Identifiers

- None

### cmake\OpenCVMinDepVersions.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVMinDepVersions.cmake
MD5: d1dde2680e36cc1889856ca3f1502d2a
SHA1: 139df4b6c44a3454d180e608dcac8a6489c68a18

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVMinDepVersions

#### Identifiers

- None

### cmake\OpenCVModule.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVModule.cmake
MD5: 5f5dcd91004c42bdf9f42babcc2d2d56
SHA1: ff2a67f9ac07ca9e24060423f17ca6c9b9249a5b

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVModule

#### Identifiers

- None

### cmake\OpenCVPackaging.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVPackaging.cmake
MD5: 523b5531ee9126224ba0573830643176
SHA1: 96797a22ee5edac0629dc40cbe823f492d531d69

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVPackaging

#### Identifiers

- None

### cmake\OpenCVPCHSupport.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVPCHSupport.cmake
MD5: 9d50a0c038a112a9f3b4312930244fd0
SHA1: ed94777aaa7d9f2b58411a3ce2ec38863473f9f7

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVPCHSupport

#### Identifiers

- None

### cmake\OpenCVUtils.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVUtils.cmake
MD5: bf033cbe5749eb6eb060c3ac076a33f8
SHA1: 97c14247374bce9ff0595063c2fe0ff96081b0fb

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVUtils

#### Identifiers

- None

### cmake\OpenCVVersion.cmake

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\cmake\OpenCVVersion.cmake
MD5: 9afc0036841d17576b57b714120fc629
SHA1: aff16bf50579427fd3e55d407b0d3ac2f72ef18e

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | OpenCVVersion

#### Identifiers

- None

### opencv\CMakeLists.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\CMakeLists.txt
MD5: b1b39612f8273876aeed9039f3aa7254
SHA1: 69a4df896246065fc9a16ff259d415c833b9c95a

#### Evidence

Source | Name | Value
--- | --- | ---
CMakeLists.txt | Project | OpenCV
file | name | CMakeLists

#### Identifiers

- None

### zlib\CMakeLists.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\zlib\CMakeLists.txt
MD5: 6452c3208faaaafdb71447a509a9c78a
SHA1: 7b4d80f4fe6bf3086fa3f6c19a8fc8179e172721

#### Evidence

Source | Name | Value
--- | --- | ---
CMakeLists.txt | Project | zlib
file | name | CMakeLists

#### Identifiers

- None

### commons-cli-1.2.jar

Description: Commons CLI provides a simple API for presenting, processing and validating a command line interface.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-cli-1.2.jar
MD5: bfdcae1ff93f0c07d733f03bdce28c9e
SHA1: 2bf96b7aa8b611c177d329452af1dc933e14501c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-cli
central | groupid | commons-cli
central | version | 1.2
file | name | commons-cli
file | version | 1.2
manifest | Bundle-Description | Commons CLI provides a simple API for presenting, processing and validating a command line interface.
Manifest | bundle-docurl | http://commons.apache.org/cli/
Manifest | Bundle-Name | Commons CLI
Manifest | bundle-symbolicname | org.apache.commons.cli
Manifest | Bundle-Version | 1.2
Manifest | Implementation-Title | Commons CLI
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.2
Manifest | specification-title | Commons CLI
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-cli
pom | description | Commons CLI provides a simple API for presenting, processing and validating a command line interface.
pom | groupid | commons-cli
pom | name | Commons CLI
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.2
pom | url | http://commons.apache.org/cli/
pom | version | 1.2

#### Identifiers

- maven: commons-cli:commons-cli:1.2 Confidence:HIGHEST

### commons-codec-1.2.jar

Description: The codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-codec-1.2.jar
MD5: 2617b220009f952bb9542af167d040cf
SHA1: 397f4731a9f9b6eb1907e224911c77ea3aa27a8b

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-codec
central | groupid | commons-codec
central | version | 1.2
file | name | commons-codec
file | version | 1.2
jar | package name | apache
jar | package name | codec
jar | package name | commons
Manifest | extension-name | org.apache.commons.codec.*
Manifest | Implementation-Title | org.apache.commons.codec.*
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id |
Manifest | Implementation-Version | 1.2
Manifest | specification-title | Jakarta Commons Codec
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | commons-codec
pom | description | The codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
pom | groupid | commons-codec
pom | name | Codec
pom | version | 1.2

#### Identifiers

- maven: commons-codec:commons-codec:1.2 Confidence:HIGHEST

### commons-collections-3.2.2.jar

Description: Types that extend and augment the Java Collections Framework.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-collections
central | groupid | commons-collections
central | version | 3.2.2
file | name | commons-collections
file | version | 3.2.2
manifest | Bundle-Description | Types that extend and augment the Java Collections Framework.
Manifest | bundle-docurl | http://commons.apache.org/collections/
Manifest | Bundle-Name | Apache Commons Collections
Manifest | bundle-symbolicname | org.apache.commons.collections
Manifest | Bundle-Version | 3.2.2
Manifest | implementation-build | tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100
Manifest | Implementation-Title | Apache Commons Collections
Manifest | implementation-url | http://commons.apache.org/collections/
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 3.2.2
Manifest | require-capability | osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))"
Manifest | specification-title | Apache Commons Collections
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-collections
pom | description | Types that extend and augment the Java Collections Framework.
pom | groupid | commons-collections
pom | name | Apache Commons Collections
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 3.2.2
pom | url | http://commons.apache.org/collections/
pom | version | 3.2.2

#### Identifiers

- maven: commons-collections:commons-collections:3.2.2 Confidence:HIGHEST
- cpe: cpe:/a:apache:commons_collections:3.2.2 Confidence:LOW

### commons-compress-1.12.jar

Description: Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-compress-1.12.jar
MD5: b394a44c74c1e904c1ab6df0893ebb7e
SHA1: 84caa68576e345eb5e7ae61a0e5a9229eb100d7b

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-compress
central | groupid | org.apache.commons
central | version | 1.12
file | name | commons-compress
file | version | 1.12
manifest | Bundle-Description | Apache Commons Compress software defines an API for working withcompression and archive formats. These include: bzip2, gzip, pack200,lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio,jar, tar, zip, dump, 7z, arj.
Manifest | bundle-docurl | http://commons.apache.org/proper/commons-compress/
Manifest | Bundle-Name | Apache Commons Compress
Manifest | bundle-symbolicname | org.apache.commons.compress
Manifest | Bundle-Version | 1.12.0
Manifest | extension-name | org.apache.commons.compress
Manifest | implementation-build | UNKNOWN@r${buildNumber}; 2016-06-18 17:29:54+0200
Manifest | Implementation-Title | Apache Commons Compress
Manifest | implementation-url | http://commons.apache.org/proper/commons-compress/
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.12
Manifest | require-capability | osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
Manifest | specification-title | Apache Commons Compress
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-compress
pom | description | Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.
pom | groupid | apache.commons
pom | name | Apache Commons Compress
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.12
pom | url | http://commons.apache.org/proper/commons-compress/
pom | version | 1.12

#### Identifiers

- cpe: cpe:/a:apache:commons-compress:1.12 Confidence:LOW
- maven: org.apache.commons:commons-compress:1.12 Confidence:HIGHEST

### commons-fileupload-1.2.1.jar

Description: The FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-fileupload-1.2.1.jar
MD5: 951b36984148fc4f4e901f06ab382273
SHA1: 384faa82e193d4e4b0546059ca09572654bc3970

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-fileupload
central | groupid | commons-fileupload
central | version | 1.2.1
file | name | commons-fileupload
file | version | 1.2.1
Manifest | Bundle-Name | Apache Commons FileUpload Bundle
Manifest | bundle-symbolicname | org.apache.commons.fileupload
Manifest | Bundle-Version | 1.2.1
Manifest | Implementation-Title | Commons FileUpload
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.2.1
Manifest | specification-title | Commons FileUpload
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-fileupload
pom | description | The FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.
pom | groupid | commons-fileupload
pom | name | Commons FileUpload
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.2.1
pom | url | http://commons.apache.org/fileupload/
pom | version | 1.2.1

#### Identifiers

- maven: commons-fileupload:commons-fileupload:1.2.1 Confidence:HIGHEST
- cpe: cpe:/a:apache:commons_fileupload:1.2.1 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2016-3092

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

- BID - 91453
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743480
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743722
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743738
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743742
- CONFIRM - http://tomcat.apache.org/security-7.html
- CONFIRM - http://tomcat.apache.org/security-8.html
- CONFIRM - http://tomcat.apache.org/security-9.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1349468
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840
- DEBIAN - DSA-3609
- DEBIAN - DSA-3611
- DEBIAN - DSA-3614
- JVN - JVN#89379547
- JVNDB - JVNDB-2016-000121
- MLIST - [dev] 20160621 CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability
- UBUNTU - USN-3024-1
- UBUNTU - USN-3027-1

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:commons_fileupload:1.3.1 and all previous versions
- ...
- cpe:/a:apache:commons_fileupload:1.3.1 and all previous versions
- cpe:/a:apache:tomcat:7.0.0
- cpe:/a:apache:tomcat:7.0.0:beta
- cpe:/a:apache:tomcat:7.0.1
- cpe:/a:apache:tomcat:7.0.2
- cpe:/a:apache:tomcat:7.0.2:beta
- cpe:/a:apache:tomcat:7.0.4
- cpe:/a:apache:tomcat:7.0.4:beta
- cpe:/a:apache:tomcat:7.0.5
- cpe:/a:apache:tomcat:7.0.5:beta
- cpe:/a:apache:tomcat:7.0.6
- cpe:/a:apache:tomcat:7.0.8
- cpe:/a:apache:tomcat:7.0.10
- cpe:/a:apache:tomcat:7.0.11
- cpe:/a:apache:tomcat:7.0.12
- cpe:/a:apache:tomcat:7.0.14
- cpe:/a:apache:tomcat:7.0.16
- cpe:/a:apache:tomcat:7.0.19
- cpe:/a:apache:tomcat:7.0.20
- cpe:/a:apache:tomcat:7.0.21
- cpe:/a:apache:tomcat:7.0.22
- cpe:/a:apache:tomcat:7.0.23
- cpe:/a:apache:tomcat:7.0.25
- cpe:/a:apache:tomcat:7.0.26
- cpe:/a:apache:tomcat:7.0.27
- cpe:/a:apache:tomcat:7.0.28
- cpe:/a:apache:tomcat:7.0.29
- cpe:/a:apache:tomcat:7.0.30
- cpe:/a:apache:tomcat:7.0.32
- cpe:/a:apache:tomcat:7.0.33
- cpe:/a:apache:tomcat:7.0.34
- cpe:/a:apache:tomcat:7.0.35
- cpe:/a:apache:tomcat:7.0.37
- cpe:/a:apache:tomcat:7.0.39
- cpe:/a:apache:tomcat:7.0.40
- cpe:/a:apache:tomcat:7.0.41
- cpe:/a:apache:tomcat:7.0.42
- cpe:/a:apache:tomcat:7.0.47
- cpe:/a:apache:tomcat:7.0.50
- cpe:/a:apache:tomcat:7.0.52
- cpe:/a:apache:tomcat:7.0.53
- cpe:/a:apache:tomcat:7.0.54
- cpe:/a:apache:tomcat:7.0.55
- cpe:/a:apache:tomcat:7.0.56
- cpe:/a:apache:tomcat:7.0.57
- cpe:/a:apache:tomcat:7.0.59
- cpe:/a:apache:tomcat:7.0.61
- cpe:/a:apache:tomcat:7.0.62
- cpe:/a:apache:tomcat:7.0.63
- cpe:/a:apache:tomcat:7.0.64
- cpe:/a:apache:tomcat:7.0.65
- cpe:/a:apache:tomcat:7.0.67
- cpe:/a:apache:tomcat:7.0.68
- cpe:/a:apache:tomcat:7.0.69
- cpe:/a:apache:tomcat:8.0.0:rc1
- cpe:/a:apache:tomcat:8.0.0:rc10
- cpe:/a:apache:tomcat:8.0.0:rc2
- cpe:/a:apache:tomcat:8.0.0:rc5
- cpe:/a:apache:tomcat:8.0.1
- cpe:/a:apache:tomcat:8.0.3
- cpe:/a:apache:tomcat:8.0.5
- cpe:/a:apache:tomcat:8.0.8
- cpe:/a:apache:tomcat:8.0.11
- cpe:/a:apache:tomcat:8.0.12
- cpe:/a:apache:tomcat:8.0.14
- cpe:/a:apache:tomcat:8.0.15
- cpe:/a:apache:tomcat:8.0.17
- cpe:/a:apache:tomcat:8.0.18
- cpe:/a:apache:tomcat:8.0.20
- cpe:/a:apache:tomcat:8.0.21
- cpe:/a:apache:tomcat:8.0.22
- cpe:/a:apache:tomcat:8.0.23
- cpe:/a:apache:tomcat:8.0.24
- cpe:/a:apache:tomcat:8.0.26
- cpe:/a:apache:tomcat:8.0.27
- cpe:/a:apache:tomcat:8.0.28
- cpe:/a:apache:tomcat:8.0.29
- cpe:/a:apache:tomcat:8.0.30
- cpe:/a:apache:tomcat:8.0.32
- cpe:/a:apache:tomcat:8.0.33
- cpe:/a:apache:tomcat:8.0.35
- cpe:/a:apache:tomcat:8.5.0
- cpe:/a:apache:tomcat:8.5.2
- cpe:/a:apache:tomcat:9.0.0:m1
- cpe:/a:apache:tomcat:9.0.0:m3
- cpe:/a:apache:tomcat:9.0.0:m4
- cpe:/a:apache:tomcat:9.0.0:m6
- cpe:/a:hp:icewall_identity_manager:5.0
- cpe:/a:hp:icewall_sso_agent_option:10.0

CVE-2014-0050

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

- BID - 65400
- BUGTRAQ - 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library
- BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- CONFIRM - http://advisories.mageia.org/MGASA-2014-0110.html
- CONFIRM - http://svn.apache.org/r1565143
- CONFIRM - http://tomcat.apache.org/security-7.html
- CONFIRM - http://tomcat.apache.org/security-8.html
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21669554
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675432
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676091
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676092
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676401
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676403
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676405
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676410
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676656
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676853
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677691
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677724
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681214
- CONFIRM - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
- CONFIRM - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
- CONFIRM - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
- CONFIRM - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1062337
- FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- HP - HPSBGN03329
- JVN - JVN#14876762
- JVNDB - JVNDB-2014-000017
- MANDRIVA - MDVSA-2015:084
- MISC - http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
- MISC - http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- MLIST - [commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS
- REDHAT - RHSA-2014:0400

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:commons_fileupload:1.2.1
- ...
- cpe:/a:apache:commons_fileupload:1.0
- cpe:/a:apache:commons_fileupload:1.1
- cpe:/a:apache:commons_fileupload:1.1.1
- cpe:/a:apache:commons_fileupload:1.2
- cpe:/a:apache:commons_fileupload:1.2.1
- cpe:/a:apache:commons_fileupload:1.2.2
- cpe:/a:apache:commons_fileupload:1.3 and all previous versions
- cpe:/a:apache:tomcat:7.0.0
- cpe:/a:apache:tomcat:7.0.0:beta
- cpe:/a:apache:tomcat:7.0.1
- cpe:/a:apache:tomcat:7.0.2
- cpe:/a:apache:tomcat:7.0.2:beta
- cpe:/a:apache:tomcat:7.0.3
- cpe:/a:apache:tomcat:7.0.4
- cpe:/a:apache:tomcat:7.0.4:beta
- cpe:/a:apache:tomcat:7.0.5
- cpe:/a:apache:tomcat:7.0.6
- cpe:/a:apache:tomcat:7.0.7
- cpe:/a:apache:tomcat:7.0.8
- cpe:/a:apache:tomcat:7.0.9
- cpe:/a:apache:tomcat:7.0.10
- cpe:/a:apache:tomcat:7.0.11
- cpe:/a:apache:tomcat:7.0.12
- cpe:/a:apache:tomcat:7.0.13
- cpe:/a:apache:tomcat:7.0.14
- cpe:/a:apache:tomcat:7.0.15
- cpe:/a:apache:tomcat:7.0.16
- cpe:/a:apache:tomcat:7.0.17
- cpe:/a:apache:tomcat:7.0.18
- cpe:/a:apache:tomcat:7.0.19
- cpe:/a:apache:tomcat:7.0.20
- cpe:/a:apache:tomcat:7.0.21
- cpe:/a:apache:tomcat:7.0.22
- cpe:/a:apache:tomcat:7.0.23
- cpe:/a:apache:tomcat:7.0.24
- cpe:/a:apache:tomcat:7.0.25
- cpe:/a:apache:tomcat:7.0.26
- cpe:/a:apache:tomcat:7.0.27
- cpe:/a:apache:tomcat:7.0.28
- cpe:/a:apache:tomcat:7.0.29
- cpe:/a:apache:tomcat:7.0.30
- cpe:/a:apache:tomcat:7.0.31
- cpe:/a:apache:tomcat:7.0.32
- cpe:/a:apache:tomcat:7.0.33
- cpe:/a:apache:tomcat:7.0.34
- cpe:/a:apache:tomcat:7.0.35
- cpe:/a:apache:tomcat:7.0.36
- cpe:/a:apache:tomcat:7.0.37
- cpe:/a:apache:tomcat:7.0.38
- cpe:/a:apache:tomcat:7.0.39
- cpe:/a:apache:tomcat:7.0.40
- cpe:/a:apache:tomcat:7.0.41
- cpe:/a:apache:tomcat:7.0.42
- cpe:/a:apache:tomcat:7.0.43
- cpe:/a:apache:tomcat:7.0.44
- cpe:/a:apache:tomcat:7.0.45
- cpe:/a:apache:tomcat:7.0.46
- cpe:/a:apache:tomcat:7.0.47
- cpe:/a:apache:tomcat:7.0.48
- cpe:/a:apache:tomcat:7.0.49
- cpe:/a:apache:tomcat:7.0.50
- cpe:/a:apache:tomcat:8.0.0:rc1
- cpe:/a:apache:tomcat:8.0.0:rc10
- cpe:/a:apache:tomcat:8.0.0:rc2
- cpe:/a:apache:tomcat:8.0.0:rc5
- cpe:/a:apache:tomcat:8.0.1
- cpe:/a:oracle:retail_applications:12.0
- cpe:/a:oracle:retail_applications:12.0in
- cpe:/a:oracle:retail_applications:13.0
- cpe:/a:oracle:retail_applications:13.1
- cpe:/a:oracle:retail_applications:13.2
- cpe:/a:oracle:retail_applications:13.3
- cpe:/a:oracle:retail_applications:13.4
- cpe:/a:oracle:retail_applications:14.0

CVE-2013-0248

Severity: Low
CVSS Score: 3.3 (AV:L/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

- BUGTRAQ - 20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples
- OSVDB - 90906

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:commons_fileupload:1.2.1
- ...
- cpe:/a:apache:commons_fileupload:1.0
- cpe:/a:apache:commons_fileupload:1.1
- cpe:/a:apache:commons_fileupload:1.1.1
- cpe:/a:apache:commons_fileupload:1.2
- cpe:/a:apache:commons_fileupload:1.2.1
- cpe:/a:apache:commons_fileupload:1.2.2

### commons-httpclient-3.1.jar

Description: The HttpClient component supports the client-side of RFC 1945 (HTTP/1.0) and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily.

License:

    Apache License: http://www.apache.org/licenses/LICENSE-2.0

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-httpclient-3.1.jar
MD5: 8ad8c9229ef2d59ab9f59f7050e846a5
SHA1: 964cd74171f427720480efdec40a7c7f6e58426a

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-httpclient
central | groupid | commons-httpclient
central | version | 3.1
file | name | commons-httpclient
file | version | 3.1
jar | package name | apache
jar | package name | commons
jar | package name | httpclient
Manifest | maven-version | 1.1
manifest: org/apache/commons/httpclient | Implementation-Title | org.apache.commons.httpclient
manifest: org/apache/commons/httpclient | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/commons/httpclient | Implementation-Version | 3.1
manifest: org/apache/commons/httpclient | Specification-Title | Jakarta Commons HttpClient
pom | artifactid | commons-httpclient
pom | description | The HttpClient component supports the client-side of RFC 1945 (HTTP/1.0) and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily.
pom | groupid | commons-httpclient
pom | name | HttpClient
pom | organization name | http://jakarta.apache.org/
pom | url | http://jakarta.apache.org/httpcomponents/httpclient-3.x/
pom | version | 3.1

#### Identifiers

- maven: commons-httpclient:commons-httpclient:3.1 Confidence:HIGHEST
- cpe: cpe:/a:apache:commons-httpclient:3.1 Confidence:LOW
- cpe: cpe:/a:apache:httpclient:3.1 Confidence:LOW

#### Published Vulnerabilities

CVE-2015-5262

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1626784
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1261538
- CONFIRM - https://issues.apache.org/jira/browse/HTTPCLIENT-1478
- FEDORA - FEDORA-2015-15588
- FEDORA - FEDORA-2015-15589
- FEDORA - FEDORA-2015-15590
- SECTRACK - 1033743
- UBUNTU - USN-2769-1

Vulnerable Software & Versions:

- cpe:/a:apache:httpclient:4.3.5 and all previous versions

CVE-2014-3577

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

- CONFIRM - https://access.redhat.com/solutions/1165533
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
- FULLDISC - 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack
- MISC - http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
- REDHAT - RHSA-2014:1146
- REDHAT - RHSA-2014:1166
- REDHAT - RHSA-2014:1833
- REDHAT - RHSA-2014:1834
- REDHAT - RHSA-2014:1835
- REDHAT - RHSA-2014:1836
- REDHAT - RHSA-2014:1891
- REDHAT - RHSA-2014:1892
- REDHAT - RHSA-2015:0125
- REDHAT - RHSA-2015:0158
- REDHAT - RHSA-2015:0675
- REDHAT - RHSA-2015:0720
- REDHAT - RHSA-2015:0765
- REDHAT - RHSA-2015:0850
- REDHAT - RHSA-2015:0851
- REDHAT - RHSA-2015:1176
- REDHAT - RHSA-2015:1177
- UBUNTU - USN-2769-1

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:httpclient:4.3.4 and all previous versions
- ...
- cpe:/a:apache:httpasyncclient:4.0
- cpe:/a:apache:httpasyncclient:4.0:alpha1
- cpe:/a:apache:httpasyncclient:4.0:alpha2
- cpe:/a:apache:httpasyncclient:4.0:alpha3
- cpe:/a:apache:httpasyncclient:4.0:beta1
- cpe:/a:apache:httpasyncclient:4.0:beta2
- cpe:/a:apache:httpasyncclient:4.0:beta3
- cpe:/a:apache:httpasyncclient:4.0:beta4
- cpe:/a:apache:httpasyncclient:4.0.1 and all previous versions
- cpe:/a:apache:httpclient:4.0
- cpe:/a:apache:httpclient:4.0:alpha1
- cpe:/a:apache:httpclient:4.0:alpha2
- cpe:/a:apache:httpclient:4.0:alpha3
- cpe:/a:apache:httpclient:4.0:alpha4
- cpe:/a:apache:httpclient:4.0:beta1
- cpe:/a:apache:httpclient:4.0:beta2
- cpe:/a:apache:httpclient:4.0.1
- cpe:/a:apache:httpclient:4.1
- cpe:/a:apache:httpclient:4.1:alpha1
- cpe:/a:apache:httpclient:4.1:alpha2
- cpe:/a:apache:httpclient:4.1:beta1
- cpe:/a:apache:httpclient:4.1.1
- cpe:/a:apache:httpclient:4.1.2
- cpe:/a:apache:httpclient:4.2
- cpe:/a:apache:httpclient:4.2:alpha1
- cpe:/a:apache:httpclient:4.2:beta1
- cpe:/a:apache:httpclient:4.2.1
- cpe:/a:apache:httpclient:4.2.2
- cpe:/a:apache:httpclient:4.2.3
- cpe:/a:apache:httpclient:4.3
- cpe:/a:apache:httpclient:4.3:alpha1
- cpe:/a:apache:httpclient:4.3:beta1
- cpe:/a:apache:httpclient:4.3:beta2
- cpe:/a:apache:httpclient:4.3.1
- cpe:/a:apache:httpclient:4.3.2
- cpe:/a:apache:httpclient:4.3.3
- cpe:/a:apache:httpclient:4.3.4 and all previous versions

### commons-io-2.5.jar

Description: The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-io-2.5.jar
MD5: e2d74794fba570ec2115fb9d5b05dc9b
SHA1: 2852e6e05fbb95076fc091f6d1780f1f8fe35e0f

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-io
central | groupid | commons-io
central | version | 2.5
file | name | commons-io
file | version | 2.5
manifest | Bundle-Description | The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
Manifest | bundle-docurl | http://commons.apache.org/proper/commons-io/
Manifest | Bundle-Name | Apache Commons IO
Manifest | bundle-symbolicname | org.apache.commons.io
Manifest | Bundle-Version | 2.5.0
Manifest | implementation-build | tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400
Manifest | Implementation-Title | Apache Commons IO
Manifest | implementation-url | http://commons.apache.org/proper/commons-io/
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 2.5
Manifest | require-capability | osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
Manifest | specification-title | Apache Commons IO
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-io
pom | description | The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
pom | groupid | commons-io
pom | name | Apache Commons IO
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 2.5
pom | url | http://commons.apache.org/proper/commons-io/
pom | version | 2.5

#### Identifiers

- maven: commons-io:commons-io:2.5 Confidence:HIGHEST

### commons-lang-2.4.jar

Description: Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-lang-2.4.jar
MD5: 237a8e845441bad2e535c57d985c8204
SHA1: 16313e02a793435009f1e458fa4af5d879f6fb11

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-lang
central | groupid | commons-lang
central | version | 2.4
file | name | commons-lang
file | version | 2.4
manifest | Bundle-Description | Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Manifest | bundle-docurl | http://commons.apache.org/lang/
Manifest | Bundle-Name | Commons Lang
Manifest | bundle-symbolicname | org.apache.commons.lang
Manifest | Bundle-Version | 2.4
Manifest | Implementation-Title | Commons Lang
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 2.4
Manifest | specification-title | Commons Lang
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-lang
pom | description | Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
pom | groupid | commons-lang
pom | name | Commons Lang
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 2.4
pom | url | http://commons.apache.org/lang/
pom | version | 2.4

#### Identifiers

- maven: commons-lang:commons-lang:2.4 Confidence:HIGHEST

### commons-lang3-3.3.2.jar

Description: Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-lang3-3.3.2.jar
MD5: 3128bf75a2549ebe38663401191bacab
SHA1: 90a3822c38ec8c996e84c16a3477ef632cbc87a3

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-lang3
central | groupid | org.apache.commons
central | version | 3.3.2
file | name | commons-lang3
file | version | 3.3.2
manifest | Bundle-Description | Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Manifest | bundle-docurl | http://commons.apache.org/proper/commons-lang/
Manifest | Bundle-Name | Apache Commons Lang
Manifest | bundle-symbolicname | org.apache.commons.lang3
Manifest | Bundle-Version | 3.3.2
Manifest | implementation-build | tags/LANG_3_3_2_RC1@r1585295; 2014-04-06 14:18:52+0200
Manifest | Implementation-Title | Apache Commons Lang
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 3.3.2
Manifest | specification-title | Apache Commons Lang
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-lang3
pom | description | Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
pom | groupid | apache.commons
pom | name | Apache Commons Lang
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 3.3.2
pom | url | http://commons.apache.org/proper/commons-lang/
pom | version | 3.3.2

#### Identifiers

- maven: org.apache.commons:commons-lang3:3.3.2 Confidence:HIGHEST

### commons-logging-1.1.1.jar

Description: Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-logging-1.1.1.jar
MD5: ed448347fc0104034aa14c8189bf37de
SHA1: 5043bfebc3db072ed80fbd362e7caf00e885d8ae

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-logging
central | groupid | commons-logging
central | version | 1.1.1
file | name | commons-logging
file | version | 1.1.1
Manifest | extension-name | org.apache.commons.logging
Manifest | Implementation-Title | Jakarta Commons Logging
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.1.1
Manifest | specification-title | Jakarta Commons Logging
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | commons-logging
pom | description | Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.
pom | groupid | commons-logging
pom | name | Commons Logging
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.1.1
pom | url | http://commons.apache.org/logging
pom | version | 1.1.1

#### Identifiers

- maven: commons-logging:commons-logging:1.1.1 Confidence:HIGHEST

### commons-pool-1.5.3.jar

Description: Commons Object Pooling Library

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-pool-1.5.3.jar
MD5: 0c6fdbaaac00387df7d738379422912e
SHA1: 7ad440d63c6eea5e79f1737e264810c76258d042

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-pool
central | groupid | commons-pool
central | version | 1.5.3
file | name | commons-pool
file | version | 1.5.3
manifest | Bundle-Description | Commons Object Pooling Library
Manifest | bundle-docurl | http://commons.apache.org/pool/
Manifest | Bundle-Name | Commons Pool
Manifest | bundle-symbolicname | org.apache.commons.pool
Manifest | Bundle-Version | 1.5.3
Manifest | Implementation-Title | Commons Pool
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.5.3
Manifest | specification-title | Commons Pool
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-pool
pom | description | Commons Object Pooling Library
pom | groupid | commons-pool
pom | name | Commons Pool
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.5.3
pom | url | http://commons.apache.org/pool/
pom | version | 1.5.3

#### Identifiers

- maven: commons-pool:commons-pool:1.5.3 Confidence:HIGHEST

### commons-validator-1.4.0.jar

Description: Commons Validator provides the building blocks for both client side validation and server side data validation. It may be used standalone or with a framework like Struts.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\commons-validator-1.4.0.jar
MD5: 8f381c168688704a85c550cf343a5ca2
SHA1: 42fa1046955ade59f5354a1876cfc523cea33815

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-validator
central | groupid | commons-validator
central | version | 1.4.0
file | name | commons-validator
file | version | 1.4.0
manifest | Bundle-Description | Commons Validator provides the building blocks for both client side validation and server side data validation. It may be used standalone or with a framework ...
Manifest | bundle-docurl | http://commons.apache.org/validator/
Manifest | Bundle-Name | Commons Validator
Manifest | bundle-symbolicname | org.apache.commons.validator
Manifest | Bundle-Version | 1.4.0
Manifest | implementation-build | tags/VALIDATOR_1_4_0_RC2@r1237247; 2012-01-29 12:53:39+0100
Manifest | Implementation-Title | Commons Validator
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.4.0
Manifest | specification-title | Commons Validator
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | commons-validator
pom | description | Commons Validator provides the building blocks for both client side validation and server side data validation. It may be used standalone or with a framework ...
pom | groupid | commons-validator
pom | name | Commons Validator
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.4.0
pom | url | http://commons.apache.org/validator/
pom | version | 1.4.0

#### Identifiers

- maven: commons-validator:commons-validator:1.4.0 Confidence:HIGHEST

### composer.lock

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 875ecf45948aeed57d09c0ddba43e5b2e99fa8c7

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | composer

#### Identifiers

- None

### daytrader-ear-2.1.7.ear

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear
MD5: 9fa8c4e8072904589fc0d1a12e8eb291
SHA1: 61868609eb138c41c0298373c9f8c19713fefa54

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | daytrader-ear
file | version | 2.1.7

#### Identifiers

- None

### daytrader-ear-2.1.7.ear: dt-ejb.jar

Description: Daytrader EJBs

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\dt-ejb.jar
MD5: 26e92dbacad11c73f03ede043b113653
SHA1: f2f7c05243ec8e5fb93efb35f5908bba88651bf3

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | daytrader-ejb
central | groupid | org.apache.geronimo.daytrader
central | version | 2.1.7
file | name | dt-ejb
jar | package name | apache
jar | package name | daytrader
jar | package name | geronimo
jar | package name | samples
pom | artifactid | daytrader-ejb
pom | description | Daytrader EJBs
pom | groupid | apache.geronimo.daytrader
pom | name | DayTrader :: Modules :: EJBs
pom | parent-artifactid | modules
pom | parent-groupid | org.apache.geronimo.daytrader
pom | version | 2.1.7

#### Identifiers

- cpe: cpe:/a:apache:geronimo:2.1.7 Confidence:HIGHEST
- maven: org.apache.geronimo.daytrader:daytrader-ejb:2.1.7 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2011-5034

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

- BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
- CERT-VN - VU#903934
- MISC - http://www.nruns.com/_downloads/advisory28122011.pdf
- MISC - http://www.ocert.org/advisories/ocert-2011-003.html
- MISC - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
- SECUNIA - 47412

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:geronimo:2.1.7
- ...
- cpe:/a:apache:geronimo:1.0
- cpe:/a:apache:geronimo:1.1
- cpe:/a:apache:geronimo:1.1.1
- cpe:/a:apache:geronimo:1.2
- cpe:/a:apache:geronimo:2.0.1
- cpe:/a:apache:geronimo:2.0.2
- cpe:/a:apache:geronimo:2.1
- cpe:/a:apache:geronimo:2.1.1
- cpe:/a:apache:geronimo:2.1.2
- cpe:/a:apache:geronimo:2.1.3
- cpe:/a:apache:geronimo:2.1.4
- cpe:/a:apache:geronimo:2.1.5
- cpe:/a:apache:geronimo:2.1.6
- cpe:/a:apache:geronimo:2.1.7
- cpe:/a:apache:geronimo:2.1.8
- cpe:/a:apache:geronimo:2.2
- cpe:/a:apache:geronimo:2.2.1 and all previous versions

CVE-2008-0732

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

- SECUNIA - 28838
- SUSE - SUSE-SR:2008:003

Vulnerable Software & Versions:

- cpe:/a:apache:geronimo

### daytrader-ear-2.1.7.ear: geronimo-jaxrpc_1.1_spec-2.0.0.jar

Description: Provides open-source implementations of Sun specifications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\geronimo-jaxrpc_1.1_spec-2.0.0.jar
MD5: 89b6273486a7c78353d919941f9f843c
SHA1: 4fad4b521e38ef8d9a2434a2421a9a1dc7910285

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-jaxrpc_1.1_spec
central | groupid | org.apache.geronimo.specs
central | version | 2.0.0
file | name | geronimo-jaxrpc_1.1_spec-2.0.0
manifest | Bundle-Description | Provides open-source implementations of Sun specifications.
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | geronimo-jaxrpc_1.1_spec
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-jaxrpc_1.1_spec
Manifest | Bundle-Version | 2.0.0
Manifest | Implementation-Title | Apache Geronimo
Manifest | Implementation-Version | 2.0.0
pom | artifactid | geronimo-jaxrpc_1.1_spec
pom | groupid | apache.geronimo.specs
pom | name | JAXRPC 1.1
pom | parent-artifactid | specs
pom | parent-groupid | org.apache.geronimo.specs
pom | parent-version | 2.0.0
pom | version | 2.0.0

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:2.0.0 Confidence:HIGHEST

### daytrader-ear-2.1.7.ear: streamer.jar

Description: Streamer Application for Day Trader

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\streamer.jar
MD5: 5bc6de1a34935d20331ef777463fd28b
SHA1: ec631c926ab667182840b3e5e32bd3d2f8a808ac

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | daytrader-streamer
central | groupid | org.apache.geronimo.daytrader
central | version | 2.1.7
file | name | streamer
Manifest | Implementation-Title | DayTrader :: Modules :: Quote Streamer
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache.geronimo.daytrader
Manifest | Implementation-Version | 2.1.7
Manifest | specification-title | DayTrader :: Modules :: Quote Streamer
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | daytrader-streamer
pom | description | Streamer Application for Day Trader
pom | groupid | apache.geronimo.daytrader
pom | name | DayTrader :: Modules :: Quote Streamer
pom | parent-artifactid | modules
pom | parent-groupid | org.apache.geronimo.daytrader
pom | version | 2.1.7

#### Identifiers

- cpe: cpe:/a:apache:apache_test:2.1.7 Confidence:LOW
- cpe: cpe:/a:apache:geronimo:2.1.7 Confidence:HIGHEST
- maven: org.apache.geronimo.daytrader:daytrader-streamer:2.1.7 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2011-5034

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

- BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
- CERT-VN - VU#903934
- MISC - http://www.nruns.com/_downloads/advisory28122011.pdf
- MISC - http://www.ocert.org/advisories/ocert-2011-003.html
- MISC - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
- SECUNIA - 47412

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:geronimo:2.1.7
- ...
- cpe:/a:apache:geronimo:1.0
- cpe:/a:apache:geronimo:1.1
- cpe:/a:apache:geronimo:1.1.1
- cpe:/a:apache:geronimo:1.2
- cpe:/a:apache:geronimo:2.0.1
- cpe:/a:apache:geronimo:2.0.2
- cpe:/a:apache:geronimo:2.1
- cpe:/a:apache:geronimo:2.1.1
- cpe:/a:apache:geronimo:2.1.2
- cpe:/a:apache:geronimo:2.1.3
- cpe:/a:apache:geronimo:2.1.4
- cpe:/a:apache:geronimo:2.1.5
- cpe:/a:apache:geronimo:2.1.6
- cpe:/a:apache:geronimo:2.1.7
- cpe:/a:apache:geronimo:2.1.8
- cpe:/a:apache:geronimo:2.2
- cpe:/a:apache:geronimo:2.2.1 and all previous versions

CVE-2008-0732

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

- SECUNIA - 28838
- SUSE - SUSE-SR:2008:003

Vulnerable Software & Versions:

- cpe:/a:apache:geronimo

### daytrader-ear-2.1.7.ear: web.war

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\web.war
MD5: 857655bb1ddb4204f09d63e5ca8c56bc
SHA1: 7a7455f5d78bb4e1b8e66cd3e6c1f964d18705f9

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | web
jar | package name | apache
jar | package name | classes
jar | package name | org
jar | package name | web-inf

#### Identifiers

- None

### daytrader-ear-2.1.7.ear: wsappclient.jar

Description: Client demonstrating Web Services

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\wsappclient.jar
MD5: c343646c162fdd19156400fe83f41ce2
SHA1: ece01974be048ba75e2b344c39efb176915a1c16

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | daytrader-wsappclient
central | groupid | org.apache.geronimo.daytrader
central | version | 2.1.7
file | name | wsappclient
Manifest | Implementation-Title | DayTrader :: Modules :: WS Application Client
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache.geronimo.daytrader
Manifest | Implementation-Version | 2.1.7
Manifest | specification-title | DayTrader :: Modules :: WS Application Client
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | daytrader-wsappclient
pom | description | Client demonstrating Web Services
pom | groupid | apache.geronimo.daytrader
pom | name | DayTrader :: Modules :: WS Application Client
pom | parent-artifactid | modules
pom | parent-groupid | org.apache.geronimo.daytrader
pom | version | 2.1.7

#### Identifiers

- cpe: cpe:/a:apache:geronimo:2.1.7 Confidence:HIGHEST
- maven: org.apache.geronimo.daytrader:daytrader-wsappclient:2.1.7 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2011-5034

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

- BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
- CERT-VN - VU#903934
- MISC - http://www.nruns.com/_downloads/advisory28122011.pdf
- MISC - http://www.ocert.org/advisories/ocert-2011-003.html
- MISC - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
- SECUNIA - 47412

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:geronimo:2.1.7
- ...
- cpe:/a:apache:geronimo:1.0
- cpe:/a:apache:geronimo:1.1
- cpe:/a:apache:geronimo:1.1.1
- cpe:/a:apache:geronimo:1.2
- cpe:/a:apache:geronimo:2.0.1
- cpe:/a:apache:geronimo:2.0.2
- cpe:/a:apache:geronimo:2.1
- cpe:/a:apache:geronimo:2.1.1
- cpe:/a:apache:geronimo:2.1.2
- cpe:/a:apache:geronimo:2.1.3
- cpe:/a:apache:geronimo:2.1.4
- cpe:/a:apache:geronimo:2.1.5
- cpe:/a:apache:geronimo:2.1.6
- cpe:/a:apache:geronimo:2.1.7
- cpe:/a:apache:geronimo:2.1.8
- cpe:/a:apache:geronimo:2.2
- cpe:/a:apache:geronimo:2.2.1 and all previous versions

CVE-2008-0732

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

- SECUNIA - 28838
- SUSE - SUSE-SR:2008:003

Vulnerable Software & Versions:

- cpe:/a:apache:geronimo

### dependency-check-utils-1.4.4-SNAPSHOT.jar

Description: dependency-check-utils is a collection of common utility classes used within dependency-check that might be useful in other projects.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\dependency-check-utils-1.4.4-SNAPSHOT.jar
MD5: c1c61050f7fdb6af867729d932610092
SHA1: 62504c3acda5ffa039bca63231caee6209dc69bb

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | dependency-check-utils
file | version | 1.4.4
Manifest | Implementation-Title | Dependency-Check Utils
Manifest | implementation-url | https://github.com/jeremylong/DependencyCheck.git/dependency-check-utils
Manifest | Implementation-Vendor | OWASP
Manifest | Implementation-Vendor-Id | org.owasp
Manifest | Implementation-Version | 1.4.4-SNAPSHOT
pom | artifactid | dependency-check-utils
pom | description | dependency-check-utils is a collection of common utility classes used within dependency-check that might be useful in other projects.
pom | groupid | owasp
pom | name | Dependency-Check Utils
pom | parent-artifactid | dependency-check-parent
pom | parent-groupid | org.owasp
pom | version | 1.4.4-SNAPSHOT

#### Identifiers

- maven: org.owasp:dependency-check-utils:1.4.4-SNAPSHOT Confidence:HIGH

### dojo-war-1.3.0.war

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\dojo-war-1.3.0.war
MD5: cd00cb6bc15004638548148a21d799aa
SHA1: 36572b4e096421becab9346da41bbc4ec1316a54

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | dojo-war
file | version | 1.3.0
jar | package name | classes
jar | package name | dojotoolkit
jar | package name | org
jar | package name | web-inf
pom | artifactid | dojo-war
pom | groupid | dojotoolkit
pom | name | Dojo Toolkit :: WAR
pom | parent-artifactid | dojo-maven
pom | parent-groupid | org.dojotoolkit
pom | version | 1.3.0

#### Identifiers

- cpe: cpe:/a:dojotoolkit:dojo:1.3 Confidence:HIGHEST
- maven: org.dojotoolkit:dojo-war:1.3.0 Confidence:HIGH

#### Published Vulnerabilities

CVE-2010-2276

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-16 Configuration

The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component.

- AIXAPAR - LO50994
- CONFIRM - http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- SECUNIA - 38964
- SECUNIA - 40007
- VUPEN - ADV-2010-1281

Vulnerable Software & Versions: (show all)

- cpe:/a:dojotoolkit:dojo:1.3
- ...
- cpe:/a:dojotoolkit:dojo:0.4.0
- cpe:/a:dojotoolkit:dojo:0.4.1
- cpe:/a:dojotoolkit:dojo:0.4.2
- cpe:/a:dojotoolkit:dojo:0.4.3
- cpe:/a:dojotoolkit:dojo:1.0
- cpe:/a:dojotoolkit:dojo:1.0.1
- cpe:/a:dojotoolkit:dojo:1.0.2
- cpe:/a:dojotoolkit:dojo:1.1
- cpe:/a:dojotoolkit:dojo:1.1.1
- cpe:/a:dojotoolkit:dojo:1.2
- cpe:/a:dojotoolkit:dojo:1.2.1
- cpe:/a:dojotoolkit:dojo:1.2.2
- cpe:/a:dojotoolkit:dojo:1.2.3
- cpe:/a:dojotoolkit:dojo:1.3
- cpe:/a:dojotoolkit:dojo:1.3.1
- cpe:/a:dojotoolkit:dojo:1.3.2
- cpe:/a:dojotoolkit:dojo:1.4
- cpe:/a:dojotoolkit:dojo:1.4.1

CVE-2010-2275

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.

- AIXAPAR - LO50896
- AIXAPAR - LO50994
- CONFIRM - http://bugs.dojotoolkit.org/ticket/10773
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- MISC - http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/
- SECUNIA - 38964
- SECUNIA - 40007
- VUPEN - ADV-2010-1281

Vulnerable Software & Versions: (show all)

- cpe:/a:dojotoolkit:dojo:1.3
- ...
- cpe:/a:dojotoolkit:dojo:0.1.0
- cpe:/a:dojotoolkit:dojo:0.2.0
- cpe:/a:dojotoolkit:dojo:0.2.1
- cpe:/a:dojotoolkit:dojo:0.2.2
- cpe:/a:dojotoolkit:dojo:0.3.0
- cpe:/a:dojotoolkit:dojo:0.3.1
- cpe:/a:dojotoolkit:dojo:0.4.0
- cpe:/a:dojotoolkit:dojo:0.4.1
- cpe:/a:dojotoolkit:dojo:0.4.2
- cpe:/a:dojotoolkit:dojo:0.4.3
- cpe:/a:dojotoolkit:dojo:0.9.0
- cpe:/a:dojotoolkit:dojo:0.9.0:beta
- cpe:/a:dojotoolkit:dojo:1.0
- cpe:/a:dojotoolkit:dojo:1.0.1
- cpe:/a:dojotoolkit:dojo:1.0.2
- cpe:/a:dojotoolkit:dojo:1.1
- cpe:/a:dojotoolkit:dojo:1.1.1
- cpe:/a:dojotoolkit:dojo:1.2
- cpe:/a:dojotoolkit:dojo:1.2.1
- cpe:/a:dojotoolkit:dojo:1.2.2
- cpe:/a:dojotoolkit:dojo:1.2.3
- cpe:/a:dojotoolkit:dojo:1.3
- cpe:/a:dojotoolkit:dojo:1.3.1
- cpe:/a:dojotoolkit:dojo:1.3.2
- cpe:/a:dojotoolkit:dojo:1.4
- cpe:/a:dojotoolkit:dojo:1.4.1 and all previous versions

CVE-2010-2274

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.

- AIXAPAR - LO50994
- CONFIRM - http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- SECUNIA - 38964
- SECUNIA - 40007
- VUPEN - ADV-2010-1281

Vulnerable Software & Versions: (show all)

- cpe:/a:dojotoolkit:dojo:1.3
- ...
- cpe:/a:dojotoolkit:dojo:1.0
- cpe:/a:dojotoolkit:dojo:1.0.1
- cpe:/a:dojotoolkit:dojo:1.0.2
- cpe:/a:dojotoolkit:dojo:1.1
- cpe:/a:dojotoolkit:dojo:1.1.1
- cpe:/a:dojotoolkit:dojo:1.2
- cpe:/a:dojotoolkit:dojo:1.2.1
- cpe:/a:dojotoolkit:dojo:1.2.2
- cpe:/a:dojotoolkit:dojo:1.2.3
- cpe:/a:dojotoolkit:dojo:1.3
- cpe:/a:dojotoolkit:dojo:1.3.1
- cpe:/a:dojotoolkit:dojo:1.3.2
- cpe:/a:dojotoolkit:dojo:1.4
- cpe:/a:dojotoolkit:dojo:1.4.1

CVE-2010-2273

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.

- AIXAPAR - LO50994
- CONFIRM - http://bugs.dojotoolkit.org/ticket/10773
- CONFIRM - http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- MISC - http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/
- SECUNIA - 38964
- SECUNIA - 40007
- VUPEN - ADV-2010-1281

Vulnerable Software & Versions: (show all)

- cpe:/a:dojotoolkit:dojo:1.3
- ...
- cpe:/a:dojotoolkit:dojo:1.0
- cpe:/a:dojotoolkit:dojo:1.0.1
- cpe:/a:dojotoolkit:dojo:1.0.2
- cpe:/a:dojotoolkit:dojo:1.1
- cpe:/a:dojotoolkit:dojo:1.1.1
- cpe:/a:dojotoolkit:dojo:1.2
- cpe:/a:dojotoolkit:dojo:1.2.1
- cpe:/a:dojotoolkit:dojo:1.2.2
- cpe:/a:dojotoolkit:dojo:1.2.3
- cpe:/a:dojotoolkit:dojo:1.3
- cpe:/a:dojotoolkit:dojo:1.3.1
- cpe:/a:dojotoolkit:dojo:1.3.2
- cpe:/a:dojotoolkit:dojo:1.4
- cpe:/a:dojotoolkit:dojo:1.4.1

### dwr.jar

Description: DWR is easy Ajax for Java.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\dwr.jar
MD5: b7f7865f90401b843ef5c032e6767f7f
SHA1: 3b8c0e896a586f825e31af06508b321b520e5aeb

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | dwr
pom | artifactid | dwr
pom | description | DWR is easy Ajax for Java.
pom | groupid | uk.ltd.getahead
pom | name | Direct Web Remoting
pom | url | http://getahead.ltd.uk/dwr
pom | version | 1.1.1

#### Related Dependencies

- dwr-1.1.1.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\dwr-1.1.1.jar
  - SHA1: 52fa2a12084cef04a5ce4e99d6dd63ba3fbf1071
  - MD5: acf4c23760ecb7377ee5047cd89afc90
  - maven: uk.ltd.getahead:dwr:1.1.1

#### Identifiers

- cpe: cpe:/a:getahead:direct_web_remoting:1.1.1 Confidence:HIGHEST
- maven: uk.ltd.getahead:dwr:1.1.1 Confidence:HIGH

#### Published Vulnerabilities

CVE-2007-0185

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.

- BID - 21955
- CONFIRM - http://getahead.ltd.uk/dwr/changelog
- OSVDB - 32658
- SECUNIA - 23641
- SUSE - SUSE-SR:2009:004
- VUPEN - ADV-2007-0095
- XF - dwr-servlet-engine-dos(31382)

Vulnerable Software & Versions: (show all)

- cpe:/a:getahead:direct_web_remoting:1.1.1
- ...
- cpe:/a:getahead:direct_web_remoting:0.7
- cpe:/a:getahead:direct_web_remoting:0.8
- cpe:/a:getahead:direct_web_remoting:0.9
- cpe:/a:getahead:direct_web_remoting:1.0
- cpe:/a:getahead:direct_web_remoting:1.1.0
- cpe:/a:getahead:direct_web_remoting:1.1.1
- cpe:/a:getahead:direct_web_remoting:1.1.2
- cpe:/a:getahead:direct_web_remoting:1.1.3 and all previous versions

CVE-2007-0184

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.

- BID - 21955
- CONFIRM - http://getahead.ltd.uk/dwr/changelog
- OSVDB - 32657
- SECUNIA - 23641
- SUSE - SUSE-SR:2009:004
- VUPEN - ADV-2007-0095
- XF - dwr-include-exclude-security-bypass(31377)

Vulnerable Software & Versions: (show all)

- cpe:/a:getahead:direct_web_remoting:1.1.1
- ...
- cpe:/a:getahead:direct_web_remoting:0.7
- cpe:/a:getahead:direct_web_remoting:0.8
- cpe:/a:getahead:direct_web_remoting:0.9
- cpe:/a:getahead:direct_web_remoting:1.0
- cpe:/a:getahead:direct_web_remoting:1.1.0
- cpe:/a:getahead:direct_web_remoting:1.1.1
- cpe:/a:getahead:direct_web_remoting:1.1.2
- cpe:/a:getahead:direct_web_remoting:1.1.3 and all previous versions

CVE-2006-6916

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input."

- CONFIRM - http://getahead.ltd.uk/dwr/changelog

Vulnerable Software & Versions:

- cpe:/a:getahead:direct_web_remoting:1.1.2 and all previous versions

### ehcache-core-2.2.0.jar

Description: This is the ehcache core module. Pair it with other modules for added functionality.

License:

    The Apache Software License, Version 2.0: src/assemble/LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ehcache-core-2.2.0.jar
MD5: 2c95e83b612691ba2a54e0c56cb9177f
SHA1: c3fba1f00073a38d370990ce7d8b5d4f9b05a11a

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | ehcache-core
central | groupid | net.sf.ehcache
central | version | 2.2.0
file | name | ehcache-core
file | version | 2.2.0
jar | package name | ehcache
jar | package name | net
jar | package name | sf
pom | artifactid | ehcache-core
pom | description | This is the ehcache core module. Pair it with other modules for added functionality.
pom | groupid | net.sf.ehcache
pom | name | Ehcache Core
pom | parent-artifactid | ehcache-parent
pom | parent-version | 2.2.0
pom | url | http://ehcache.org
pom | version | 2.2.0

#### Identifiers

- maven: net.sf.ehcache:ehcache-core:2.2.0 Confidence:HIGHEST

### FileHelpers.2.0.0.0.nupkg

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\FileHelpers.2.0.0.0.nupkg
MD5: 0bf948b505852a2af8a597b8a129ef9a
SHA1: 30fb37d6163cf16e3ba740343becdd14d5457619

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | FileHelpers.2.0.0.0
file | version | 2.0.0.0

#### Identifiers

- cpe: cpe:/a:file:file:2.0.0.0 Confidence:LOW

#### Published Vulnerabilities

CVE-2007-1536

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-189 Numeric Errors

Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

- APPLE - APPLE-SA-2007-05-24
- BID - 23021
- BUGTRAQ - 20070825 OpenBSD 4.1 - Heap overflow vulnerabillity
- BUGTRAQ - 20070828 Re: OpenBSD 4.1 - Heap overflow vulnerabillity
- CERT-VN - VU#606700
- CONFIRM - http://docs.info.apple.com/article.html?artnum=305530
- CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-179.htm
- CONFIRM - https://bugs.gentoo.org/show_bug.cgi?id=171452
- CONFIRM - https://issues.rpath.com/browse/RPL-1148
- DEBIAN - DSA-1274
- FREEBSD - FreeBSD-SA-07:04
- GENTOO - GLSA-200703-26
- GENTOO - GLSA-200710-19
- MANDRIVA - MDKSA-2007:067
- MLIST - [file] 20070302 file-4.20 is now available
- NETBSD - NetBSD-SA2008-001
- OPENBSD - [4.0] 20070709 015: SECURITY FIX: July 9, 2007
- REDHAT - RHSA-2007:0124
- SECTRACK - 1017796
- SECUNIA - 24548
- SECUNIA - 24592
- SECUNIA - 24604
- SECUNIA - 24608
- SECUNIA - 24616
- SECUNIA - 24617
- SECUNIA - 24723
- SECUNIA - 24754
- SECUNIA - 25133
- SECUNIA - 25393
- SECUNIA - 25402
- SECUNIA - 25931
- SECUNIA - 25989
- SECUNIA - 27307
- SECUNIA - 27314
- SECUNIA - 29179
- SLACKWARE - SSA:2007-093-01
- SUSE - SUSE-SA:2007:040
- SUSE - SUSE-SR:2007:005
- UBUNTU - USN-439-1
- VUPEN - ADV-2007-1040
- VUPEN - ADV-2007-1939
- XF - openbsd-file-bo(36283)

Vulnerable Software & Versions:

- cpe:/a:file:file:4.19 and all previous versions

### FileHelpers.2.0.0.0.nupkg: FileHelpers.nuspec

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\FileHelpers.2.0.0.0.nupkg\FileHelpers.nuspec
MD5: 9e2287f0174bcd79cf7e2427d73a1197
SHA1: d14a722b66388d84ac3b57c4de56e702aa5fea96

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | FileHelpers
nuspec | authors | Marcos Meli
nuspec | id | FileHelpers
nuspec | owners | Marcos Meli
nuspec | title | FileHelpers Lib http://www.filehelpers.com
nuspec | version | 2.0.0.0

#### Identifiers

- None

### FileHelpers.2.0.0.0.nupkg: FileHelpers.dll

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\FileHelpers.dll
MD5: 4829fa768de37c315a3a3b7bca027b64
SHA1: a256f622a6209ec21a13d490443ffd6dbda4f5b7

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | FileHelpers
grokassembly | product | FileHelpers
grokassembly | vendor | Marcos Meli
grokassembly | version | 2.0.0.0

#### Identifiers

- None

### FileHelpers.2.0.0.0.nupkg: FileHelpers.ExcelStorage.dll

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\FileHelpers.ExcelStorage.dll
MD5: d22aeca6ee71a2e6f5b3d296280ba98a
SHA1: e416350e2ee0e0711e2716cf7efce54168accc52

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | FileHelpers.ExcelStorage
grokassembly | product | FileHelpers.ExcelStorage
grokassembly | vendor | Marcos Meli
grokassembly | version | 2.0.0.0

#### Identifiers

- None

### FileHelpers.2.0.0.0.nupkg: Interop.Excel.dll

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\Interop.Excel.dll
MD5: 728ff3aeae71cbd8d303f442e3843c4c
SHA1: cdaa993485f737951fd91c71f41c929cd06dffa3

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | Interop.Excel
grokassembly | product | Interop.Excel
grokassembly | vendor |
grokassembly | version | 1.3.0.0

#### Identifiers

- None

### FileHelpers.2.0.0.0.nupkg: Interop.Office.dll

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\Interop.Office.dll
MD5: 7b55e3bf19775b7a6fa5bf3c271e2c0c
SHA1: eefcfe4b0c90b6f4232d07d588a08bc04fd32e84

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | Interop.Office
grokassembly | product | Interop.Office
grokassembly | vendor |
grokassembly | version | 2.1.0.0

#### Identifiers

- None

### freemarker-2.3.12.jar

Description: FreeMarker is a "template engine"; a generic tool to generate text output based on templates.

License:

    BSD-style license: http://www.freemarker.org/LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\freemarker-2.3.12.jar
MD5: 719554bbc3d8a98582a8a93328134fe2
SHA1: 3501b670aa7e3822ddf7693082f621b1cd8ce086

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | freemarker
central | groupid | org.freemarker
central | version | 2.3.12
file | name | freemarker
file | version | 2.3.12
jar | package name | freemarker
Manifest | extension-name | FreeMarker
Manifest | Implementation-Title | VSS Java FreeMarker
Manifest | Implementation-Vendor | Visigoth Software Society
Manifest | Implementation-Version | 2.3.12
Manifest | specification-title | FreeMarker
Manifest | specification-vendor | Visigoth Software Society
pom | artifactid | freemarker
pom | description | FreeMarker is a "template engine"; a generic tool to generate text output based on templates.
pom | groupid | freemarker
pom | name | FreeMarker
pom | url | http://www.freemarker.org
pom | version | 2.3.12

#### Identifiers

- maven: org.freemarker:freemarker:2.3.12 Confidence:HIGHEST

### geronimo-activation_1.1_spec-1.0.1.jar

Description: Provides open-source implementations of Sun specifications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\geronimo-activation_1.1_spec-1.0.1.jar
MD5: fd89b8782af5fd2ac1cadb006477e828
SHA1: 79c75e201af44cf766e78a2515c3f88a19f69e1f

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-activation_1.1_spec
central | groupid | org.apache.geronimo.specs
central | version | 1.0.1
file | name | geronimo-activation_1.1_spec-1.0.1
manifest | Bundle-Description | Provides open-source implementations of Sun specifications.
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | geronimo-activation_1.1_spec
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-activation_1.1_spec
Manifest | Bundle-Version | 1.0.1
Manifest | Implementation-Title | Apache Geronimo
Manifest | Implementation-Version | 1.0.1
pom | artifactid | geronimo-activation_1.1_spec
pom | groupid | apache.geronimo.specs
pom | name | Activation 1.1
pom | parent-artifactid | specs
pom | parent-groupid | org.apache.geronimo.specs
pom | parent-version | 1.0.1
pom | version | 1.0.1

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-activation_1.1_spec:1.0.1 Confidence:HIGHEST

### geronimo-javamail_1.4_spec-1.2.jar

Description: Provides open-source implementations of Sun specifications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\geronimo-javamail_1.4_spec-1.2.jar
MD5: f9f0465816f2db5fa9f409fb1d9700c8
SHA1: 0f6b07582a3d6ba452b10527fb508809aff8b353

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-javamail_1.4_spec
central | groupid | org.apache.geronimo.specs
central | version | 1.2
file | name | geronimo-javamail_1.4_spec-1.2
manifest | Bundle-Description | Provides open-source implementations of Sun specifications.
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | geronimo-javamail_1.4_spec
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-javamail_1.4_spec
Manifest | Bundle-Version | 1.2
Manifest | Implementation-Title | Apache Geronimo
Manifest | Implementation-Version | 1.2
pom | artifactid | geronimo-javamail_1.4_spec
pom | groupid | apache.geronimo.specs
pom | name | JavaMail 1.4
pom | parent-artifactid | specs
pom | parent-groupid | org.apache.geronimo.specs
pom | parent-version | 1.2
pom | version | 1.2

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-javamail_1.4_spec:1.2 Confidence:HIGHEST

### geronimo-jms_1.1_spec-1.1.1.jar

Description: Provides open-source implementations of Sun specifications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\geronimo-jms_1.1_spec-1.1.1.jar
MD5: d80ce71285696d36c1add1989b94f084
SHA1: c872b46c601d8dc03633288b81269f9e42762cea

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-jms_1.1_spec
central | groupid | org.apache.geronimo.specs
central | version | 1.1.1
file | name | geronimo-jms_1.1_spec-1.1.1
manifest | Bundle-Description | Provides open-source implementations of Sun specifications.
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | geronimo-jms_1.1_spec
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-jms_1.1_spec
Manifest | Bundle-Version | 1.1.1
Manifest | Implementation-Title | Apache Geronimo
Manifest | Implementation-Version | 1.1.1
pom | artifactid | geronimo-jms_1.1_spec
pom | groupid | apache.geronimo.specs
pom | name | JMS 1.1
pom | parent-artifactid | specs
pom | parent-groupid | org.apache.geronimo.specs
pom | parent-version | 1.1.1
pom | version | 1.1.1

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1 Confidence:HIGHEST

### geronimo-jpa_2.0_spec-1.1.jar

Description: Implementation of Sun JSR-317 JPA 2.0 Spec API

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\geronimo-jpa_2.0_spec-1.1.jar
MD5: 007c972f6dcfea68a6686b262c6f3d2f
SHA1: f4d90788691f5f5f201f39a53a23d392cde660a3

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-jpa_2.0_spec
central | groupid | org.apache.geronimo.specs
central | version | 1.1
file | name | geronimo-jpa_2.0_spec-1.1
manifest | Bundle-Description | Implementation of Sun JSR-317 JPA 2.0 Spec API
Manifest | bundle-docurl | http://geronimo.apache.org/maven/specs/geronimo-jpa_2.0_spec/1.1
Manifest | Bundle-Name | Apache Geronimo JSR-317 JPA 2.0 Spec API
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-jpa_2.0_spec;singleton=true
Manifest | Bundle-Version | 1.1
Manifest | Implementation-Title | Apache Geronimo JSR-317 JPA 2.0 Spec API
Manifest | Implementation-Version | 1.1
Manifest | specification-title | JSR-317 Java Persistence API 2.0
Manifest | specification-vendor | Sun Microsystems, Inc.
pom | artifactid | geronimo-jpa_2.0_spec
pom | description | Implementation of Sun JSR-317 JPA 2.0 Spec API
pom | groupid | apache.geronimo.specs
pom | name | Apache Geronimo JSR-317 JPA 2.0 Spec API
pom | parent-artifactid | genesis-java5-flava
pom | parent-groupid | org.apache.geronimo.genesis
pom | parent-version | 1.1
pom | url | http://geronimo.apache.org/maven/${siteId}/${version}
pom | version | 1.1

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-jpa_2.0_spec:1.1 Confidence:HIGHEST

### geronimo-jta_1.1_spec-1.1.1.jar

Description: Provides open-source implementations of Sun specifications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\geronimo-jta_1.1_spec-1.1.1.jar
MD5: 4aa8d50456bcec0bf6f032ceb182ad64
SHA1: aabab3165b8ea936b9360abbf448459c0d04a5a4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-jta_1.1_spec
central | groupid | org.apache.geronimo.specs
central | version | 1.1.1
file | name | geronimo-jta_1.1_spec-1.1.1
manifest | Bundle-Description | Provides open-source implementations of Sun specifications.
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | geronimo-jta_1.1_spec
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-jta_1.1_spec
Manifest | Bundle-Version | 1.1.1
Manifest | Implementation-Title | Apache Geronimo
Manifest | Implementation-Version | 1.1.1
pom | artifactid | geronimo-jta_1.1_spec
pom | groupid | apache.geronimo.specs
pom | name | JTA 1.1
pom | parent-artifactid | specs
pom | parent-groupid | org.apache.geronimo.specs
pom | parent-version | 1.1.1
pom | version | 1.1.1

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-jta_1.1_spec:1.1.1 Confidence:HIGHEST

### geronimo-stax-api_1.0_spec-1.0.1.jar

Description: Provides open-source implementations of Sun specifications.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\geronimo-stax-api_1.0_spec-1.0.1.jar
MD5: b7c2a715cd3d1c43dc4ccfae426e8e2e
SHA1: 1c171093a8b43aa550c6050ac441abe713ebb4f2

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | geronimo-stax-api_1.0_spec
central | groupid | org.apache.geronimo.specs
central | version | 1.0.1
file | name | geronimo-stax-api_1.0_spec-1.0.1
manifest | Bundle-Description | Provides open-source implementations of Sun specifications.
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | geronimo-stax-api_1.0_spec
Manifest | bundle-symbolicname | org.apache.geronimo.specs.geronimo-stax-api_1.0_spec
Manifest | Bundle-Version | 1.0.1
Manifest | Implementation-Title | Apache Geronimo
Manifest | Implementation-Version | 1.0.1
pom | artifactid | geronimo-stax-api_1.0_spec
pom | groupid | apache.geronimo.specs
pom | name | Streaming API for XML (STAX API 1.0)
pom | parent-artifactid | specs
pom | parent-groupid | org.apache.geronimo.specs
pom | parent-version | 1.0.1
pom | version | 1.0.1

#### Identifiers

- maven: org.apache.geronimo.specs:geronimo-stax-api_1.0_spec:1.0.1 Confidence:HIGHEST

### guice-3.0.jar

Description: Guice is a lightweight dependency injection framework for Java 5 and above

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\guice-3.0.jar
MD5: ca1c7ba366884cfcd2cfb48d2395c400
SHA1: 9d84f15fe35e2c716a02979fb62f50a29f38aefa

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | guice
central | groupid | com.google.inject
central | version | 3.0
file | name | guice
file | version | 3.0
jar | package name | google
jar | package name | inject
jar | package name | internal
Manifest | bundle-copyright | 2006
Manifest | bundle-copyright | Copyright (C) 2006 Google Inc.
manifest | Bundle-Description | Guice is a lightweight dependency injection framework for Java 5 and above
Manifest | bundle-docurl | http://code.google.com/p/google-guice/
Manifest | Bundle-Name | guice
Manifest | bundle-requiredexecutionenvironment | J2SE-1.5,JavaSE-1.6
Manifest | bundle-symbolicname | com.google.inject
Manifest | Bundle-Version | 3.0.0
pom | artifactid | guice
pom | groupid | google.inject
pom | name | Google Guice - Core Library
pom | parent-artifactid | guice-parent
pom | parent-groupid | com.google.inject
pom | version | 3.0

#### Identifiers

- maven: com.google.inject:guice:3.0 Confidence:HIGHEST

### h2-1.3.176.jar

Description: H2 Database Engine

License:

    The H2 License, Version 1.0: http://h2database.com/html/license.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\h2-1.3.176.jar
MD5: 9c15d378136b31e4fd8f54561e90713a
SHA1: fd369423346b2f1525c413e33f8cf95b09c92cbd

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | h2
central | groupid | com.h2database
central | version | 1.3.176
file | name | h2
file | version | 1.3.176
jar | package name | h2
Manifest | Bundle-Name | H2 Database Engine
Manifest | bundle-symbolicname | org.h2
Manifest | Bundle-Version | 1.3.176
Manifest | Implementation-Title | H2 Database Engine
Manifest | implementation-url | http://www.h2database.com
Manifest | Implementation-Version | 1.3.176
pom | artifactid | h2
pom | description | H2 Database Engine
pom | groupid | h2database
pom | name | H2 Database Engine
pom | url | http://www.h2database.com
pom | version | 1.3.176

#### Identifiers

- maven: com.h2database:h2:1.3.176 Confidence:HIGHEST

### hamcrest-core-1.3.jar

Description: This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hamcrest-core-1.3.jar
MD5: 6393363b47ddcbba82321110c3e07519
SHA1: 42a25dc3219429f0e5d060061f71acb49bf010a0

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | hamcrest-core
central | groupid | org.hamcrest
central | version | 1.3
file | name | hamcrest-core
file | version | 1.3
jar | package name | hamcrest
Manifest | built-date | 2012-07-09 19:49:34
Manifest | Implementation-Title | hamcrest-core
Manifest | Implementation-Vendor | hamcrest.org
Manifest | Implementation-Version | 1.3
pom | artifactid | hamcrest-core
pom | description | This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations.
pom | groupid | hamcrest
pom | name | Hamcrest Core
pom | parent-artifactid | hamcrest-parent
pom | parent-groupid | org.hamcrest
pom | version | 1.3

#### Identifiers

- maven: org.hamcrest:hamcrest-core:1.3 Confidence:HIGHEST

### hazelcast-2.5.jar

Description: Hazelcast In-Memory DataGrid

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hazelcast-2.5.jar
MD5: cecb9f89cf60f8947451f620e542cbc8
SHA1: 3614fa9e42e8cd4d124ca37a2edb36d0e926959d

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | hazelcast
central | groupid | com.hazelcast
central | version | 2.5
file | name | hazelcast
file | version | 2.5
manifest | Bundle-Description | Hazelcast In-Memory DataGrid
Manifest | bundle-docurl | http://www.hazelcast.com/
Manifest | Bundle-Name | hazelcast
Manifest | bundle-symbolicname | com.hazelcast
Manifest | Bundle-Version | 2.5.0
Manifest | Implementation-Title | hazelcast
Manifest | Implementation-Vendor | Hazelcast, Inc.
Manifest | Implementation-Vendor-Id | com.hazelcast
Manifest | Implementation-Version | 2.5
Manifest | specification-title | hazelcast
pom | artifactid | hazelcast
pom | groupid | hazelcast
pom | name | hazelcast
pom | parent-artifactid | hazelcast-root
pom | parent-groupid | com.hazelcast
pom | version | 2.5

#### Identifiers

- maven: com.hazelcast:hazelcast:2.5 Confidence:HIGHEST

### hibernate3.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar
MD5: b22bbafa38341db968033f1acbfa8dd9
SHA1: 826da9fc452e7009116dffc2d348ba705fe2aa82

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | hibernate3
file | version | 3
jar | package name | hibernate
Manifest | Implementation-Title | Hibernate Distribution
Manifest | implementation-url | http://hibernate.org
Manifest | Implementation-Vendor | Hibernate.org
Manifest | Implementation-Vendor-Id | org.hibernate
Manifest | Implementation-Version | 3.6.6.Final
Manifest | specification-title | Hibernate Distribution
Manifest | specification-vendor | Hibernate.org

#### Identifiers

- None

### httpcore-4.0-beta1.jar

Description: HttpComponents Core (Java 1.3 compatible)

License:

    Apache License: ../LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\httpcore-4.0-beta1.jar
MD5: 7515cfff71e32ce55d5ba6b73251d93a
SHA1: c642a5f7c20539840957584b1af2ad798cd1ba52

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | httpcore
central | groupid | org.apache.httpcomponents
central | version | 4.0-beta1
file | name | httpcore
file | version | 4.0.beta
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 4.0-beta1
pom | artifactid | httpcore
pom | description | HttpComponents Core (Java 1.3 compatible)
pom | groupid | apache.httpcomponents
pom | name | HttpCore (base module)
pom | parent-artifactid | httpcomponents-core
pom | parent-groupid | org.apache.httpcomponents
pom | url | http://hc.apache.org/httpcomponents-core/
pom | version | 4.0-beta1

#### Identifiers

- maven: org.apache.httpcomponents:httpcore:4.0-beta1 Confidence:HIGHEST

### httpcore-nio-4.0-beta1.jar

Description: HttpComponents Core (NIO extensions)

License:

    Apache License: ../LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\httpcore-nio-4.0-beta1.jar
MD5: 926965bc84b5f5f138df66ddd05baed0
SHA1: a0d825beaa0bc0b03fcf11315abc4b7fd60fe2e8

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | httpcore-nio
central | groupid | org.apache.httpcomponents
central | version | 4.0-beta1
file | name | httpcore-nio
file | version | 4.0.beta
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 4.0-beta1
pom | artifactid | httpcore-nio
pom | description | HttpComponents Core (NIO extensions)
pom | groupid | apache.httpcomponents
pom | name | HttpCore (NIO extensions module)
pom | parent-artifactid | httpcomponents-core
pom | parent-groupid | org.apache.httpcomponents
pom | url | http://hc.apache.org/httpcomponents-core/
pom | version | 4.0-beta1

#### Identifiers

- maven: org.apache.httpcomponents:httpcore-nio:4.0-beta1 Confidence:HIGHEST

### javax.inject-1.jar

Description: The javax.inject API

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | javax.inject
central | groupid | javax.inject
central | version | 1
file | name | javax.inject-1
file | version | 1
jar | package name | inject
jar | package name | javax
pom | artifactid | javax.inject
pom | description | The javax.inject API
pom | groupid | javax.inject
pom | name | javax.inject
pom | url | http://code.google.com/p/atinject/
pom | version | 1

#### Identifiers

- maven: javax.inject:javax.inject:1 Confidence:HIGHEST

### javax.json-1.0.4.jar

Description: Default provider for JSR 353:Java API for Processing JSON

License:

    https://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\javax.json-1.0.4.jar
MD5: 569870f975deeeb6691fcb9bc02a9555
SHA1: 3178f73569fd7a1e5ffc464e680f7a8cc784b85a

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | javax.json
central | groupid | org.glassfish
central | version | 1.0.4
file | name | javax.json
file | version | 1.0.4
manifest | Bundle-Description | Default provider for JSR 353:Java API for Processing JSON
Manifest | bundle-docurl | http://www.oracle.com
Manifest | Bundle-Name | JSR 353 (JSON Processing) Default Provider
Manifest | bundle-symbolicname | org.glassfish.javax.json
Manifest | Bundle-Version | 1.0.4
Manifest | extension-name | javax.json
Manifest | Implementation-Version | 1.0.4
pom | artifactid | javax.json
pom | description | Default provider for JSR 353:Java API for Processing JSON
pom | groupid | glassfish
pom | name | JSR 353 (JSON Processing) Default Provider
pom | parent-artifactid | json
pom | parent-groupid | org.glassfish
pom | url | http://jsonp.java.net
pom | version | 1.0.4

#### Identifiers

- maven: org.glassfish:javax.json:1.0.4 Confidence:HIGHEST

### jaxb-xercesImpl-1.5.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jaxb-xercesImpl-1.5.jar
MD5: 8cd074364c830fc8ff40a8a19c0a74c8
SHA1: 73a51faadb407dccdbd77234e0d5a0a648665692

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jaxb-xercesImpl
central | artifactid | xercesImpl
central | groupid | activesoap
central | version | 1.5
file | name | jaxb-xercesImpl
file | version | 1.5
jar | package name | apache
jar | package name | org
jar | package name | sun
jar | package name | xerces
jar (hint) | package name | oracle
Manifest | extension-name | com.sun.org.apache.xerces.internal
Manifest | Implementation-Title | Xerces 2 Parser Implementation (of JAXP RI 1.2.6 )
Manifest | implementation-url | http://xml.apache.org/xerces2-j
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | Xerces-J_2_6_2
Manifest | specification-title | Java API for XML Processing
Manifest | specification-vendor | Sun Microsystems Inc.
pom | artifactid | jaxb-xercesImpl
pom | groupid | activesoap
pom | version | 1.5

#### Identifiers

- maven: activesoap:jaxb-xercesImpl:1.5 Confidence:HIGHEST
- maven: activesoap:xercesImpl:1.5 Confidence:HIGHEST

### jaxen-1.1.1.jar

Description: Jaxen is a universal Java XPath engine.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jaxen-1.1.1.jar
MD5: 261d1aa59865842ecc32b3848b0c6538
SHA1: 9f5d3c5974dbe5cf69c2c2ec7d8a4eb6e0fce7f9

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jaxen
central | groupid | jaxen
central | version | 1.1.1
file | name | jaxen
file | version | 1.1.1
jar | package name | jaxen
Manifest | extension-name | jaxen
Manifest | Implementation-Title | org.jaxen
Manifest | Implementation-Vendor | Codehaus
Manifest | Implementation-Version | 1.1.1
Manifest | specification-title | Universal Java XPath Engine
Manifest | specification-vendor | Codehaus
pom | artifactid | jaxen
pom | description | Jaxen is a universal Java XPath engine.
pom | groupid | jaxen
pom | name | jaxen
pom | organization name | http://codehaus.org
pom | url | http://jaxen.codehaus.org/
pom | version | 1.1.1

#### Identifiers

- maven: jaxen:jaxen:1.1.1 Confidence:HIGHEST

### jcip-annotations-1.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jcip-annotations-1.0.jar
MD5: 9d5272954896c5a5d234f66b7372b17a
SHA1: afba4942caaeaf46aab0b976afd57cc7c181467e

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jcip-annotations
central | groupid | net.jcip
central | version | 1.0
file | name | jcip-annotations
file | version | 1.0
jar | package name | annotations
jar | package name | jcip
jar | package name | net
pom | artifactid | jcip-annotations
pom | groupid | net.jcip
pom | name | "Java Concurrency in Practice" book annotations
pom | url | http://jcip.net/
pom | version | 1.0

#### Identifiers

- maven: net.jcip:jcip-annotations:1.0 Confidence:HIGHEST

### jetty-6.1.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jetty-6.1.0.jar
MD5: 121a72b1dea1a9adf83079a44ca08e7b
SHA1: fb39ebc0cdccea6b54ad87d229a352a894eebecc

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jetty
central | groupid | org.mortbay.jetty
central | version | 6.1.0
file | name | jetty
file | version | 6.1.0
Manifest | implementation-version | 6.1.0
Manifest | url | http://jetty.mortbay.org
pom | artifactid | jetty
pom | groupid | mortbay.jetty
pom | name | Jetty Server
pom | parent-artifactid | project
pom | parent-groupid | org.mortbay.jetty
pom | url | http://jetty.mortbay.org
pom | version | 6.1.0

#### Related Dependencies

- jetty-util-6.1.0.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jetty-util-6.1.0.jar
  - SHA1: 965aae938d48f094546c1918a0bbed0adbe54595
  - MD5: a1f1f4d11d58ad4af4b534b2265bd82f
  - maven: org.mortbay.jetty:jetty-util:6.1.0

#### Identifiers

- cpe: cpe:/a:jetty:jetty:6.1.0 Confidence:LOW
- cpe: cpe:/a:mortbay:jetty:6.1.0 Confidence:HIGHEST
- cpe: cpe:/a:mortbay_jetty:jetty:6.1 Confidence:HIGHEST
- maven: org.mortbay.jetty:jetty:6.1.0 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2011-4461

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-310 Cryptographic Issues

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

- BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
- CERT-VN - VU#903934
- MISC - http://www.nruns.com/_downloads/advisory28122011.pdf
- MISC - http://www.ocert.org/advisories/ocert-2011-003.html
- SECTRACK - 1026475
- SECUNIA - 47408
- SECUNIA - 48981
- UBUNTU - USN-1429-1
- XF - jetty-hash-dos(72017)

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:morbtay:jetty:6.1.0
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.11
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1
- cpe:/a:mortbay:jetty:5.1:rc0
- cpe:/a:mortbay:jetty:5.1:rc1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0
- cpe:/a:mortbay:jetty:5.1.5:rc1
- cpe:/a:mortbay:jetty:5.1.5:rc2
- cpe:/a:mortbay:jetty:5.1.6
- cpe:/a:mortbay:jetty:5.1.7
- cpe:/a:mortbay:jetty:5.1.7:rc0
- cpe:/a:mortbay:jetty:5.1.8
- cpe:/a:mortbay:jetty:5.1.9
- cpe:/a:mortbay:jetty:5.1.10
- cpe:/a:mortbay:jetty:5.1.11
- cpe:/a:mortbay:jetty:5.1.11:rc0
- cpe:/a:mortbay:jetty:5.1.12
- cpe:/a:mortbay:jetty:5.1.13
- cpe:/a:mortbay:jetty:5.1.14
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16
- cpe:/a:mortbay:jetty:6.1.19
- cpe:/a:mortbay:jetty:6.1.20
- cpe:/a:mortbay:jetty:6.1.21
- cpe:/a:mortbay:jetty:7.0.0
- cpe:/a:mortbay:jetty:7.0.0:m1
- cpe:/a:mortbay:jetty:7.0.0:m2
- cpe:/a:mortbay:jetty:7.0.0:pre0
- cpe:/a:mortbay:jetty:7.0.0:pre1
- cpe:/a:mortbay:jetty:7.0.0:pre3
- cpe:/a:mortbay:jetty:8.1.0:rc2 and all previous versions

CVE-2009-4612

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.

- MISC - http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16
- cpe:/a:mortbay:jetty:6.1.19
- cpe:/a:mortbay:jetty:6.1.20
- cpe:/a:mortbay:jetty:6.1.21

CVE-2009-4611

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

Mort Bay Jetty 6.x and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.

- BUGTRAQ - 20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection
- MISC - http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
- MISC - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16
- cpe:/a:mortbay:jetty:6.1.19
- cpe:/a:mortbay:jetty:6.1.20
- cpe:/a:mortbay:jetty:7.0.0

CVE-2009-4610

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.

- MISC - http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16
- cpe:/a:mortbay:jetty:6.1.19
- cpe:/a:mortbay:jetty:6.1.20
- cpe:/a:mortbay:jetty:7.0.0

CVE-2009-4609

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.

- MISC - http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16
- cpe:/a:mortbay:jetty:6.1.19
- cpe:/a:mortbay:jetty:6.1.20
- cpe:/a:mortbay:jetty:7.0.0

CVE-2009-1524

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.

- BID - 34800
- CONFIRM - http://jira.codehaus.org/browse/JETTY-980
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=499867
- HP - HPSBMA02553
- HP - SSRT100184
- SECUNIA - 34975
- SECUNIA - 40553
- VUPEN - ADV-2010-1792

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1:rc0
- cpe:/a:mortbay:jetty:5.1:rc1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0
- cpe:/a:mortbay:jetty:5.1.5:rc1
- cpe:/a:mortbay:jetty:5.1.5:rc2
- cpe:/a:mortbay:jetty:5.1.6
- cpe:/a:mortbay:jetty:5.1.7
- cpe:/a:mortbay:jetty:5.1.7:rc0
- cpe:/a:mortbay:jetty:5.1.8
- cpe:/a:mortbay:jetty:5.1.9
- cpe:/a:mortbay:jetty:5.1.10
- cpe:/a:mortbay:jetty:5.1.11
- cpe:/a:mortbay:jetty:5.1.11:rc0
- cpe:/a:mortbay:jetty:5.1.12
- cpe:/a:mortbay:jetty:5.1.13
- cpe:/a:mortbay:jetty:5.1.14
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16 and all previous versions

CVE-2009-1523

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

- BID - 34800
- BID - 35675
- CERT-VN - VU#402580
- CONFIRM - http://jira.codehaus.org/browse/JETTY-1004
- CONFIRM - http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=499867
- FEDORA - FEDORA-2009-5500
- FEDORA - FEDORA-2009-5509
- FEDORA - FEDORA-2009-5513
- HP - HPSBMA02553
- HP - SSRT100184
- SECTRACK - 1022563
- SECUNIA - 34975
- SECUNIA - 35143
- SECUNIA - 35225
- SECUNIA - 35776
- SECUNIA - 40553
- VUPEN - ADV-2009-1900
- VUPEN - ADV-2010-1792

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:6.1.0
- ...
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1:rc0
- cpe:/a:mortbay:jetty:5.1:rc1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0
- cpe:/a:mortbay:jetty:5.1.5:rc1
- cpe:/a:mortbay:jetty:5.1.5:rc2
- cpe:/a:mortbay:jetty:5.1.6
- cpe:/a:mortbay:jetty:5.1.7
- cpe:/a:mortbay:jetty:5.1.7:rc0
- cpe:/a:mortbay:jetty:5.1.8
- cpe:/a:mortbay:jetty:5.1.9
- cpe:/a:mortbay:jetty:5.1.10
- cpe:/a:mortbay:jetty:5.1.11
- cpe:/a:mortbay:jetty:5.1.11:rc0
- cpe:/a:mortbay:jetty:5.1.12
- cpe:/a:mortbay:jetty:5.1.13
- cpe:/a:mortbay:jetty:5.1.14
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0
- cpe:/a:mortbay:jetty:7.0.0:m1 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:m2 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:pre0 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:pre1 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:pre3 and all previous versions

CVE-2007-5615

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

- BID - 26696
- CERT-VN - VU#212984
- CONFIRM - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
- FEDORA - FEDORA-2008-6141
- FEDORA - FEDORA-2008-6164
- OSVDB - 42495
- SECUNIA - 27925
- SECUNIA - 30941
- SECUNIA - 35143
- SUSE - SUSE-SR:2009:004

Vulnerable Software & Versions:

- cpe:/a:mortbay_jetty:jetty:6.1.6rc0 and all previous versions

CVE-2007-5614

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

- BID - 26695
- CERT-VN - VU#438616
- CONFIRM - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
- FEDORA - FEDORA-2008-6141
- FEDORA - FEDORA-2008-6164
- OSVDB - 42496
- SECUNIA - 27925
- SECUNIA - 30941
- SECUNIA - 35143

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay_jetty:jetty:6.1
- ...
- cpe:/a:mortbay_jetty:jetty:1.0
- cpe:/a:mortbay_jetty:jetty:2.4
- cpe:/a:mortbay_jetty:jetty:3.0
- cpe:/a:mortbay_jetty:jetty:3.1
- cpe:/a:mortbay_jetty:jetty:4.0
- cpe:/a:mortbay_jetty:jetty:4.1
- cpe:/a:mortbay_jetty:jetty:4.2
- cpe:/a:mortbay_jetty:jetty:5
- cpe:/a:mortbay_jetty:jetty:5.1
- cpe:/a:mortbay_jetty:jetty:6
- cpe:/a:mortbay_jetty:jetty:6.1

CVE-2007-5613

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.

- BID - 26697
- CERT-VN - VU#237888
- CONFIRM - http://jira.codehaus.org/browse/JETTY-452
- CONFIRM - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
- FEDORA - FEDORA-2008-6141
- FEDORA - FEDORA-2008-6164
- OSVDB - 42497
- SECUNIA - 27925
- SECUNIA - 30941
- SECUNIA - 35143
- SUSE - SUSE-SR:2009:004

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay_jetty:jetty:6.1
- ...
- cpe:/a:mortbay_jetty:jetty:1.0
- cpe:/a:mortbay_jetty:jetty:2.4
- cpe:/a:mortbay_jetty:jetty:3.0
- cpe:/a:mortbay_jetty:jetty:3.1
- cpe:/a:mortbay_jetty:jetty:4.0
- cpe:/a:mortbay_jetty:jetty:4.1
- cpe:/a:mortbay_jetty:jetty:4.2
- cpe:/a:mortbay_jetty:jetty:5
- cpe:/a:mortbay_jetty:jetty:5.1
- cpe:/a:mortbay_jetty:jetty:6
- cpe:/a:mortbay_jetty:jetty:6.1

### jmockit-1.24.jar

Description: JMockit is a Java toolkit for automated developer testing. It contains mocking and faking APIs and a code coverage tool, supporting both JUnit and TestNG. The mocking API allows all kinds of Java code, without testability restrictions, to be tested in isolation from selected dependencies.

License:

    The MIT License: http://www.opensource.org/licenses/mit-license.php

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jmockit-1.24.jar
MD5: 27c6e2be6bda6f78f83604d1f1d40006
SHA1: c8f3d57267a9979727da9d679921f1e60fa2beec

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jmockit
central | groupid | org.jmockit
central | version | 1.24
file | name | jmockit
file | version | 1.24
jar | package name | internal
jar | package name | mockit
pom | artifactid | jmockit
pom | description | JMockit is a Java toolkit for automated developer testing. It contains mocking and faking APIs and a code coverage tool, supporting both JUnit and TestNG. The mocking API allows all kinds of Java code, without testability restrictions, to be tested in isolation from selected dependencies.
pom | groupid | jmockit
pom | name | Main
pom | url | http://www.jmockit.org
pom | version | 1.24

#### Identifiers

- maven: org.jmockit:jmockit:1.24 Confidence:HIGHEST

### jsoup-1.9.2.jar

Description: jsoup HTML parser

License:

    The MIT License: https://jsoup.org/license

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jsoup-1.9.2.jar
MD5: a8627c801e0d16169ef9ca83cf89861a
SHA1: 5e3bda828a80c7a21dfbe2308d1755759c2fd7b4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jsoup
central | groupid | org.jsoup
central | version | 1.9.2
file | name | jsoup
file | version | 1.9.2
manifest | Bundle-Description | jsoup HTML parser
Manifest | bundle-docurl | http://jsoup.org/
Manifest | Bundle-Name | jsoup
Manifest | bundle-symbolicname | org.jsoup
Manifest | Bundle-Version | 1.9.2
pom | artifactid | jsoup
pom | description | jsoup HTML parser
pom | groupid | jsoup
pom | name | jsoup
pom | organization name | http://jonathanhedley.com/
pom | url | https://jsoup.org/
pom | version | 1.9.2

#### Identifiers

- maven: org.jsoup:jsoup:1.9.2 Confidence:HIGHEST

### jsr305-3.0.1.jar

Description: JSR305 Annotations for Findbugs

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\jsr305-3.0.1.jar
MD5: c6532beb3f7cc54a8d73d25d5602b9e4
SHA1: f7be08ec23c21485b9b5a1cf1654c2ec8c58168d

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jsr305
central | groupid | com.google.code.findbugs
central | version | 3.0.1
file | name | jsr305
file | version | 3.0.1
manifest | Bundle-Description | JSR305 Annotations for Findbugs
Manifest | Bundle-Name | FindBugs-jsr305
Manifest | bundle-symbolicname | org.jsr-305
Manifest | Bundle-Version | 3.0.1
pom | artifactid | jsr305
pom | description | JSR305 Annotations for Findbugs
pom | groupid | google.code.findbugs
pom | name | FindBugs-jsr305
pom | url | http://findbugs.sourceforge.net/
pom | version | 3.0.1

#### Identifiers

- maven: com.google.code.findbugs:jsr305:3.0.1 Confidence:HIGHEST

### junit-4.12.jar

Description: JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.

License:

    Eclipse Public License 1.0: http://www.eclipse.org/legal/epl-v10.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\junit-4.12.jar
MD5: 5b38c40c97fbd0adee29f91e60405584
SHA1: 2973d150c0dc1fefe998f834810d68f278ea58ec

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | junit
central | groupid | junit
central | version | 4.12
file | name | junit
file | version | 4.12
jar | package name | junit
Manifest | Implementation-Title | JUnit
Manifest | Implementation-Vendor | JUnit
Manifest | Implementation-Vendor-Id | junit
Manifest | Implementation-Version | 4.12
pom | artifactid | junit
pom | description | JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.
pom | groupid | junit
pom | name | JUnit
pom | organization name | http://www.junit.org
pom | url | http://junit.org
pom | version | 4.12

#### Identifiers

- maven: junit:junit:4.12 Confidence:HIGHEST

### junit4-ant-2.0.13.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\junit4-ant-2.0.13.jar
MD5: ebab7fecab4398e859176ecb81e63d0e
SHA1: 33904a47c5f920d270437ea1075cc9fa5ecb8099

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | junit4-ant
central | groupid | com.carrotsearch.randomizedtesting
central | version | 2.0.13
file | name | junit4-ant
file | version | 2.0.13
jar | package name | ant
jar | package name | carrotsearch
jar | package name | junit4
jar | package name | tasks
pom | artifactid | junit4-ant
pom | groupid | carrotsearch.randomizedtesting
pom | name | RandomizedTesting JUnit4 ANT Task
pom | parent-artifactid | randomizedtesting-parent
pom | parent-groupid | com.carrotsearch.randomizedtesting
pom | version | 2.0.13

#### Identifiers

- maven: com.carrotsearch.randomizedtesting:junit4-ant:2.0.13 Confidence:HIGHEST

### log4net.2.0.3.nuspec

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\log4net.2.0.3.nuspec
MD5: d95207bfd2539c046ba7271b695b08f7
SHA1: b82102a0767f56525926698fbba4b7c47e96d4ab

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | log4net.2.0.3
file | version | 2.0.3
nuspec | authors | Apache Software Foundation
nuspec | id | log4net
nuspec | owners | Apache Software Foundation
nuspec | title | log4net [1.2.13]
nuspec | version | 2.0.3

#### Identifiers

- cpe: cpe:/a:apache:log4net:2.0.3 Confidence:LOW

### log4net.dll

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\log4net.dll
MD5: e873f47ff9ed73a7ed7054aaf4e7601a
SHA1: 44d7ee86c72be615da883a24f0b54fd0725ad298

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | log4net
file | version | 4
grokassembly | product | log4net
grokassembly | vendor | The Apache Software Foundation
grokassembly | version | 1.2.13.0

#### Identifiers

- cpe: cpe:/a:apache:log4net:1.2.13.0 Confidence:LOW

### logback-classic-1.1.7.jar

Description: logback-classic module

License:

    http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\logback-classic-1.1.7.jar
MD5: 7373c8ad1bfa162332d7d13c4596c2a1
SHA1: 9865cf6994f9ff13fce0bf93f2054ef6c65bb462

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | logback-classic
central | groupid | ch.qos.logback
central | version | 1.1.7
file | name | logback-classic
file | version | 1.1.7
manifest | Bundle-Description | logback-classic module
Manifest | bundle-docurl | http://www.qos.ch
Manifest | Bundle-Name | Logback Classic Module
Manifest | bundle-requiredexecutionenvironment | JavaSE-1.6
Manifest | bundle-symbolicname | ch.qos.logback.classic
Manifest | Bundle-Version | 1.1.7
Manifest | originally-created-by | Apache Maven Bundle Plugin
Manifest | require-capability | osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
pom | artifactid | logback-classic
pom | description | logback-classic module
pom | groupid | ch.qos.logback
pom | name | Logback Classic Module
pom | parent-artifactid | logback-parent
pom | version | 1.1.7

#### Identifiers

- maven: ch.qos.logback:logback-classic:1.1.7 Confidence:HIGHEST

### logback-core-1.1.7.jar

Description: logback-core module

License:

    http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\logback-core-1.1.7.jar
MD5: 4021551de5018dfa4b79ec553280f00a
SHA1: 7873092d39ef741575ca91378a6a21c388363ac8

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | logback-core
central | groupid | ch.qos.logback
central | version | 1.1.7
file | name | logback-core
file | version | 1.1.7
manifest | Bundle-Description | logback-core module
Manifest | bundle-docurl | http://www.qos.ch
Manifest | Bundle-Name | Logback Core Module
Manifest | bundle-requiredexecutionenvironment | JavaSE-1.6
Manifest | bundle-symbolicname | ch.qos.logback.core
Manifest | Bundle-Version | 1.1.7
Manifest | originally-created-by | Apache Maven Bundle Plugin
Manifest | require-capability | osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
pom | artifactid | logback-core
pom | description | logback-core module
pom | groupid | ch.qos.logback
pom | name | Logback Core Module
pom | parent-artifactid | logback-parent
pom | version | 1.1.7

#### Identifiers

- maven: ch.qos.logback:logback-core:1.1.7 Confidence:HIGHEST

### lucene-analyzers-common-4.7.2.jar

Description: Additional Analyzers

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-analyzers-common-4.7.2.jar
MD5: cbc49dfc4ed6ee29db3a1ed5a84c5a9e
SHA1: 72017b7643f6e2389a140099a3fce198a569b599

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-analyzers-common
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-analyzers-common
file | version | 4.7.2
jar | package name | analysis
jar | package name | apache
jar | package name | lucene
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:00:55
Manifest | specification-title | Lucene Search Engine: analyzers-common
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-analyzers-common
pom | description | Additional Analyzers
pom | groupid | apache.lucene
pom | name | Lucene Common Analyzers
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- maven: org.apache.lucene:lucene-analyzers-common:4.7.2 Confidence:HIGHEST

### lucene-codecs-4.7.2.jar

Description: Codecs and postings formats for Apache Lucene.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-codecs-4.7.2.jar
MD5: c442ec2c5e403d9c6f8ba8ad8762cd81
SHA1: 386adfd04528461f9ddfa0ff839190f6a6d9c1a5

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-codecs
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-codecs
file | version | 4.7.2
jar | package name | apache
jar | package name | codecs
jar | package name | lucene
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:01:03
Manifest | specification-title | Lucene Search Engine: codecs
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-codecs
pom | description | Codecs and postings formats for Apache Lucene.
pom | groupid | apache.lucene
pom | name | Lucene codecs
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- maven: org.apache.lucene:lucene-codecs:4.7.2 Confidence:HIGHEST

### lucene-core-4.7.2.jar

Description: Apache Lucene Java Core

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-core-4.7.2.jar
MD5: 6ed7375bfe046610363a10915ce2dd8b
SHA1: c9ec1d5b48635aa032ca3d2c824dea0e6523a4a5

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-core
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-core
file | version | 4.7.2
jar | package name | apache
jar | package name | lucene
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:00:35
Manifest | specification-title | Lucene Search Engine: core
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-core
pom | description | Apache Lucene Java Core
pom | groupid | apache.lucene
pom | name | Lucene Core
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- maven: org.apache.lucene:lucene-core:4.7.2 Confidence:HIGHEST

### lucene-queries-4.7.2.jar

Description: Lucene Queries Module

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-queries-4.7.2.jar
MD5: fe815419a0aff3f76452ac516fffb680
SHA1: c357a2494e341f2680fccbf9e96138c7083aaad4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-queries
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-queries
file | version | 4.7.2
jar | package name | apache
jar | package name | function
jar | package name | lucene
jar | package name | queries
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:01:08
Manifest | specification-title | Lucene Search Engine: queries
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-queries
pom | description | Lucene Queries Module
pom | groupid | apache.lucene
pom | name | Lucene Queries
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- maven: org.apache.lucene:lucene-queries:4.7.2 Confidence:HIGHEST

### lucene-queryparser-4.7.2.jar

Description: Lucene QueryParsers module

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-queryparser-4.7.2.jar
MD5: e7c72fce30aae45d9e3ad43b24b2a58f
SHA1: 0ef6eb0d081065d3b69a4f097eec115a80f3a8f7

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-queryparser
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-queryparser
file | version | 4.7.2
jar | package name | apache
jar | package name | flexible
jar | package name | lucene
jar | package name | queryparser
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:01:09
Manifest | specification-title | Lucene Search Engine: queryparser
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-queryparser
pom | description | Lucene QueryParsers module
pom | groupid | apache.lucene
pom | name | Lucene QueryParsers
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- maven: org.apache.lucene:lucene-queryparser:4.7.2 Confidence:HIGHEST

### lucene-sandbox-4.7.2.jar

Description: Lucene Sandbox

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-sandbox-4.7.2.jar
MD5: a6e13813e4bf0d0053423a51b6588f4d
SHA1: 447747b4ddd1f2af2ae8a1759ada5988393e945c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-sandbox
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-sandbox
file | version | 4.7.2
jar | package name | apache
jar | package name | lucene
jar | package name | queries
jar | package name | sandbox
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:01:10
Manifest | specification-title | Lucene Search Engine: sandbox
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-sandbox
pom | description | Lucene Sandbox
pom | groupid | apache.lucene
pom | name | Lucene Sandbox
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- maven: org.apache.lucene:lucene-sandbox:4.7.2 Confidence:HIGHEST

### lucene-test-framework-4.7.2.jar

Description: Apache Lucene Java Test Framework

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\lucene-test-framework-4.7.2.jar
MD5: ceef8bf76c02cb58b40d6e43a22c5165
SHA1: 194947eb27a42e777c2a02ff3b6842c8dbfd2678

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | lucene-test-framework
central | groupid | org.apache.lucene
central | version | 4.7.2
file | name | lucene-test-framework
file | version | 4.7.2
jar | package name | apache
jar | package name | lucene
Manifest | extension-name | org.apache.lucene
Manifest | Implementation-Title | org.apache.lucene
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Version | 4.7.2 1586229 - rmuir - 2014-04-10 09:00:36
Manifest | specification-title | Lucene Search Engine: test-framework
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | lucene-test-framework
pom | description | Apache Lucene Java Test Framework
pom | groupid | apache.lucene
pom | name | Lucene Test Framework
pom | parent-artifactid | lucene-parent
pom | parent-groupid | org.apache.lucene
pom | version | 4.7.2

#### Identifiers

- cpe: cpe:/a:apache:apache_test:4.7.2 Confidence:LOW
- maven: org.apache.lucene:lucene-test-framework:4.7.2 Confidence:HIGHEST

### mail-1.4.jar

Description: The JavaMail API provides a platform-independent and protocol-independent framework to build mail and messaging applications.

License:

    Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\mail-1.4.jar
MD5: 2e64a3805d543bdb86e6e5eeca5529f8
SHA1: 1aa1579ae5ecd41920c4f355b0a9ef40b68315dd

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | mail
central | groupid | javax.mail
central | version | 1.4
file | name | mail
file | version | 1.4
jar | package name | javax
jar | package name | mail
Manifest | extension-name | javax.mail
Manifest | Implementation-Title | JavaMail(TM) API Reference Implementation
Manifest | Implementation-Vendor | Sun Microsystems, Inc.
Manifest | Implementation-Vendor-Id | com.sun
Manifest | Implementation-Version | 1.4
Manifest | specification-title | JavaMail(TM) API Design Specification
Manifest | specification-vendor | Sun Microsystems, Inc.
pom | artifactid | mail
pom | description | The JavaMail API provides a platform-independent and protocol-independent framework to build mail and messaging applications.
pom | groupid | javax.mail
pom | name | JavaMail API
pom | url | https://glassfish.dev.java.net/javaee5/mail/
pom | version | 1.4

#### Identifiers

- cpe: cpe:/a:sun:javamail:1.4 Confidence:LOW
- maven: javax.mail:mail:1.4 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2007-6059

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products."

- BUGTRAQ - 20071116 Javamail login username and password same email problem
- OSVDB - 45299

Vulnerable Software & Versions:

- cpe:/a:sun:javamail

### mailapi-1.5.6.jar

Description: JavaMail API (no providers)

License:

    https://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\mailapi-1.5.6.jar
MD5: 2d5d81cd7a3e1ca3caab3a3d70add6f7
SHA1: 8fe524d88c28362b50052200c28149bc8f1f45e4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | mailapi
central | groupid | com.sun.mail
central | version | 1.5.6
file | name | mailapi
file | version | 1.5.6
manifest | Bundle-Description | JavaMail API (no providers)
Manifest | bundle-docurl | http://www.oracle.com
Manifest | Bundle-Name | JavaMail API (no providers)
Manifest | bundle-symbolicname | javax.mail.api
Manifest | Bundle-Version | 1.5.6
Manifest | extension-name | javax.mail
Manifest | Implementation-Title | javax.mail
Manifest | Implementation-Vendor | Oracle
Manifest | Implementation-Vendor-Id | com.sun
Manifest | Implementation-Version | 1.5.6
Manifest | originally-created-by | 1.8.0_92 (Oracle Corporation)
Manifest | probe-provider-xml-file-names | META-INF/gfprobe-provider.xml
Manifest | specification-title | JavaMail(TM) API Design Specification
Manifest | specification-vendor | Oracle
Manifest (hint) | Implementation-Vendor | sun
Manifest (hint) | specification-vendor | sun
pom | artifactid | mailapi
pom | groupid | sun.mail
pom | name | JavaMail API (no providers)
pom | parent-artifactid | all
pom | parent-groupid | com.sun.mail
pom | version | 1.5.6

#### Identifiers

- maven: com.sun.mail:mailapi:1.5.6 Confidence:HIGHEST
- cpe: cpe:/a:sun:javamail:1.5.6 Confidence:LOW

#### Published Vulnerabilities

CVE-2007-6059

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products."

- BUGTRAQ - 20071116 Javamail login username and password same email problem
- OSVDB - 45299

Vulnerable Software & Versions:

- cpe:/a:sun:javamail

### maven-scm-api-1.8.1.jar

Description: The SCM API provides mechanisms to manage all SCM tools.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\maven-scm-api-1.8.1.jar
MD5: c409fc1a6c9baf928cc37b2ffb852c83
SHA1: d72bcdc54a873e8bfbc53fde6200e53911c3d9fe

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | maven-scm-api
central | groupid | org.apache.maven.scm
central | version | 1.8.1
file | name | maven-scm-api
file | version | 1.8.1
Manifest | Implementation-Title | Maven SCM API
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache.maven.scm
Manifest | Implementation-Version | 1.8.1
Manifest | specification-title | Maven SCM API
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | maven-scm-api
pom | description | The SCM API provides mechanisms to manage all SCM tools.
pom | groupid | apache.maven.scm
pom | name | Maven SCM API
pom | parent-artifactid | maven-scm
pom | parent-groupid | org.apache.maven.scm
pom | version | 1.8.1

#### Identifiers

- maven: org.apache.maven.scm:maven-scm-api:1.8.1 Confidence:HIGHEST

### maven-scm-provider-cvs-commons-1.8.1.jar

Description: Common library for SCM CVS Provider.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\maven-scm-provider-cvs-commons-1.8.1.jar
MD5: 7d35f493a22226b821b5d5363e85765c
SHA1: 97411239d474ecafcc2ab89facaf2593eb0de49b

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | maven-scm-provider-cvs-commons
central | groupid | org.apache.maven.scm
central | version | 1.8.1
file | name | maven-scm-provider-cvs-commons
file | version | 1.8.1
Manifest | Implementation-Title | Maven SCM CVS Provider - Common library
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache.maven.scm
Manifest | Implementation-Version | 1.8.1
Manifest | specification-title | Maven SCM CVS Provider - Common library
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | maven-scm-provider-cvs-commons
pom | description | Common library for SCM CVS Provider.
pom | groupid | apache.maven.scm
pom | name | Maven SCM CVS Provider - Common library
pom | parent-artifactid | maven-scm-providers-cvs
pom | parent-groupid | org.apache.maven.scm
pom | version | 1.8.1

#### Identifiers

- maven: org.apache.maven.scm:maven-scm-provider-cvs-commons:1.8.1 Confidence:HIGHEST

### maven-scm-provider-cvsexe-1.8.1.jar

Description: Executable implementation for SCM CVS Provider.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\maven-scm-provider-cvsexe-1.8.1.jar
MD5: 8900abe1192b79b35aedb0f683a8b412
SHA1: 5c7bf6d2c741885d2a6c17cb044ff8e2966f69ca

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | maven-scm-provider-cvsexe
central | groupid | org.apache.maven.scm
central | version | 1.8.1
file | name | maven-scm-provider-cvsexe
file | version | 1.8.1
Manifest | Implementation-Title | Maven SCM CVS Provider - CVS Executable Impl.
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache.maven.scm
Manifest | Implementation-Version | 1.8.1
Manifest | specification-title | Maven SCM CVS Provider - CVS Executable Impl.
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | maven-scm-provider-cvsexe
pom | description | Executable implementation for SCM CVS Provider.
pom | groupid | apache.maven.scm
pom | name | Maven SCM CVS Provider - CVS Executable Impl.
pom | parent-artifactid | maven-scm-providers-cvs
pom | parent-groupid | org.apache.maven.scm
pom | version | 1.8.1

#### Identifiers

- maven: org.apache.maven.scm:maven-scm-provider-cvsexe:1.8.1 Confidence:HIGHEST

### mysql-connector-java-5.1.27-bin.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\mysql-connector-java-5.1.27-bin.jar
MD5: 0317d93cccab2dd08a7a3cca06403e78
SHA1: 180296391137c12da3ba2a35dcc93ef23fb2c1ff

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | mysql-connector-java
file | version | 5.1.27
jar | package name | jdbc
jar | package name | mysql
Manifest | Bundle-Name | Oracle Corporation' JDBC Driver for MySQL
Manifest | bundle-symbolicname | com.mysql.jdbc
Manifest | Bundle-Version | 5.1.27
manifest: common | Implementation-Title | MySQL Connector Java
manifest: common | Implementation-Vendor | Oracle
manifest: common | Implementation-Version | 5.1.27
manifest: common | Specification-Title | JDBC
manifest: common (hint) | Implementation-Vendor | sun

#### Identifiers

- cpe: cpe:/a:mysql:mysql:5.1.27 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2015-2575

Severity: Medium
CVSS Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)

Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- DEBIAN - DSA-3621
- SUSE - SUSE-SU-2015:0946

Vulnerable Software & Versions:

- cpe:/a:mysql:mysql:5.1.34 and all previous versions

CVE-2014-0437

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

- BID - 64758
- BID - 64849
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20140437(90385)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71
- cpe:/a:oracle:mysql:5.1.72 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33
- cpe:/a:oracle:mysql:5.5.34 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13
- cpe:/a:oracle:mysql:5.6.14 and all previous versions

CVE-2014-0412

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

- BID - 64758
- BID - 64880
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20140412(90378)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71
- cpe:/a:oracle:mysql:5.1.72 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33
- cpe:/a:oracle:mysql:5.5.34 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13
- cpe:/a:oracle:mysql:5.6.14 and all previous versions

CVE-2014-0402

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.

- BID - 64758
- BID - 64908
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20140402(90379)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13 and all previous versions

CVE-2014-0401

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.

- BID - 64758
- BID - 64898
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20140401(90382)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71
- cpe:/a:oracle:mysql:5.1.72 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33
- cpe:/a:oracle:mysql:5.5.34 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13
- cpe:/a:oracle:mysql:5.6.14 and all previous versions

CVE-2014-0393

Severity: Low
CVSS Score: 3.3 (AV:N/AC:L/Au:M/C:N/I:P/A:N)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.

- BID - 64758
- BID - 64877
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20140393(90386)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13 and all previous versions

CVE-2014-0386

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

- BID - 64758
- BID - 64904
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20140386(90380)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13 and all previous versions

CVE-2014-0001

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.

- CONFIRM - http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/2502.565.64
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1054592
- CONFIRM - https://mariadb.com/kb/en/mariadb-5535-changelog/
- MANDRIVA - MDVSA-2014:029
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql
- ...
- cpe:/a:mariadb:mariadb:5.5.34 and all previous versions
- cpe:/a:mysql:mysql

CVE-2013-5908

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote attackers to affect availability via unknown vectors related to Error Handling.

- BID - 64758
- BID - 64896
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- DEBIAN - DSA-2845
- DEBIAN - DSA-2848
- OSVDB - 102078
- REDHAT - RHSA-2014:0164
- REDHAT - RHSA-2014:0173
- REDHAT - RHSA-2014:0186
- REDHAT - RHSA-2014:0189
- SECUNIA - 56491
- SECUNIA - 56541
- SECUNIA - 56580
- UBUNTU - USN-2086-1
- XF - oracle-cpujan2014-cve20135908(90389)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69
- cpe:/a:oracle:mysql:5.1.70
- cpe:/a:oracle:mysql:5.1.71
- cpe:/a:oracle:mysql:5.1.72 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31
- cpe:/a:oracle:mysql:5.5.32
- cpe:/a:oracle:mysql:5.5.33
- cpe:/a:oracle:mysql:5.5.34 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11
- cpe:/a:oracle:mysql:5.6.12
- cpe:/a:oracle:mysql:5.6.13
- cpe:/a:oracle:mysql:5.6.14 and all previous versions

CVE-2013-3808

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Server Options.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- GENTOO - GLSA-201308-06
- OSVDB - 95330
- SECUNIA - 53372
- SUSE - SUSE-SU-2013:1390
- SUSE - SUSE-SU-2013:1529
- SUSE - openSUSE-SU-2013:1335
- SUSE - openSUSE-SU-2013:1410
- XF - oracle-cpujuly2013-cve20133808(85717)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10 and all previous versions

CVE-2013-3804

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- DEBIAN - DSA-2818
- GENTOO - GLSA-201308-06
- OSVDB - 95328
- SECUNIA - 53372
- SECUNIA - 54300
- SUSE - SUSE-SU-2013:1390
- SUSE - SUSE-SU-2013:1529
- SUSE - openSUSE-SU-2013:1335
- SUSE - openSUSE-SU-2013:1410
- UBUNTU - USN-1909-1
- XF - oracle-cpujuly2013-cve20133804(85715)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11 and all previous versions

CVE-2013-3802

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Full Text Search.

- BID - 61244
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- DEBIAN - DSA-2818
- GENTOO - GLSA-201308-06
- OSVDB - 95325
- SECUNIA - 53372
- SECUNIA - 54300
- SUSE - SUSE-SU-2013:1390
- SUSE - SUSE-SU-2013:1529
- SUSE - openSUSE-SU-2013:1335
- SUSE - openSUSE-SU-2013:1410
- UBUNTU - USN-1909-1
- XF - oracle-cpujuly2013-cve20133802(85712)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68
- cpe:/a:oracle:mysql:5.1.69 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30
- cpe:/a:oracle:mysql:5.5.31 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10
- cpe:/a:oracle:mysql:5.6.11 and all previous versions

CVE-2013-2392

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10 and all previous versions

CVE-2013-2391

Severity: Low
CVSS Score: 3.0 (AV:L/AC:M/Au:S/C:P/I:P/A:N)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows local users to affect confidentiality and integrity via unknown vectors related to Server Install.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10 and all previous versions

CVE-2013-2389

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.1.68 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29
- cpe:/a:oracle:mysql:5.5.30 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10 and all previous versions

CVE-2013-2378

Severity: Medium
CVSS Score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10 and all previous versions

CVE-2013-1555

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, and 5.5.29 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Partition.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67 and all previous versions
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29 and all previous versions

CVE-2013-1552

Severity: Medium
CVSS Score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67 and all previous versions
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29 and all previous versions

CVE-2013-1548

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.63 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Types.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63 and all previous versions

CVE-2013-1521

Severity: Medium
CVSS Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Locking.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29 and all previous versions

CVE-2013-1506

Severity: Low
CVSS Score: 2.8 (AV:N/AC:M/Au:M/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Locking.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0772
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29 and all previous versions
- cpe:/a:oracle:mysql:5.6.0
- cpe:/a:oracle:mysql:5.6.1
- cpe:/a:oracle:mysql:5.6.2
- cpe:/a:oracle:mysql:5.6.3
- cpe:/a:oracle:mysql:5.6.4
- cpe:/a:oracle:mysql:5.6.5
- cpe:/a:oracle:mysql:5.6.6
- cpe:/a:oracle:mysql:5.6.7
- cpe:/a:oracle:mysql:5.6.8
- cpe:/a:oracle:mysql:5.6.9
- cpe:/a:oracle:mysql:5.6.10 and all previous versions

CVE-2013-1492

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.

- CONFIRM - https://blogs.oracle.com/sunsecurity/entry/cve_2013_1492_buffer_overflow
- GENTOO - GLSA-201308-06
- MISC - http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html
- MISC - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-30.html
- SECUNIA - 52445
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28
- cpe:/a:oracle:mysql:5.5.29

CVE-2013-0389

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2013-0385

Severity: Medium
CVSS Score: 6.6 (AV:L/AC:L/Au:N/C:C/I:C/A:N)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows local users to affect confidentiality and integrity via unknown vectors related to Server Replication.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2013-0384

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Information Schema.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2013-0383

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2013-0375

Severity: Medium
CVSS Score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Server Replication.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28 and all previous versions
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions

CVE-2012-5627

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-255 Credentials Management

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

- CONFIRM - https://mariadb.atlassian.net/browse/MDEV-3915
- FULLDISC - 20121203 MySQL Local/Remote FAST Account Password Cracking
- FULLDISC - 20121205 Re: MySQL Local/Remote FAST Account Password Cracking
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:102
- MISC - https://bugzilla.redhat.com/show_bug.cgi?id=883719
- MLIST - [oss-security] 20121206 Re: CVE request: Mysql/Mariadb insecure salt-usage
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql
- ...
- cpe:/a:mariadb:mariadb:5.2.0
- cpe:/a:mariadb:mariadb:5.2.1
- cpe:/a:mariadb:mariadb:5.2.2
- cpe:/a:mariadb:mariadb:5.2.3
- cpe:/a:mariadb:mariadb:5.2.4
- cpe:/a:mariadb:mariadb:5.2.5
- cpe:/a:mariadb:mariadb:5.2.6
- cpe:/a:mariadb:mariadb:5.2.7
- cpe:/a:mariadb:mariadb:5.2.8
- cpe:/a:mariadb:mariadb:5.2.9
- cpe:/a:mariadb:mariadb:5.2.10
- cpe:/a:mariadb:mariadb:5.2.11
- cpe:/a:mariadb:mariadb:5.2.12
- cpe:/a:mariadb:mariadb:5.2.13
- cpe:/a:mariadb:mariadb:5.3.0
- cpe:/a:mariadb:mariadb:5.3.1
- cpe:/a:mariadb:mariadb:5.3.2
- cpe:/a:mariadb:mariadb:5.3.3
- cpe:/a:mariadb:mariadb:5.3.4
- cpe:/a:mariadb:mariadb:5.3.5
- cpe:/a:mariadb:mariadb:5.3.6
- cpe:/a:mariadb:mariadb:5.3.7
- cpe:/a:mariadb:mariadb:5.3.8
- cpe:/a:mariadb:mariadb:5.3.9
- cpe:/a:mariadb:mariadb:5.3.10
- cpe:/a:mariadb:mariadb:5.3.11
- cpe:/a:mariadb:mariadb:5.5.20
- cpe:/a:mariadb:mariadb:5.5.21
- cpe:/a:mariadb:mariadb:5.5.22
- cpe:/a:mariadb:mariadb:5.5.23
- cpe:/a:mariadb:mariadb:5.5.24
- cpe:/a:mariadb:mariadb:5.5.25
- cpe:/a:mariadb:mariadb:5.5.27
- cpe:/a:mariadb:mariadb:5.5.28
- cpe:/a:mysql:mysql

CVE-2012-5060

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.65 and earlier and 5.5.27 and earlier allows remote authenticated users to affect availability, related to GIS Extension.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27 and all previous versions

CVE-2012-3197

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-serverreplication-dos(79393)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26 and all previous versions

CVE-2012-3180

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-optimize-dos(79389)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27 and all previous versions

CVE-2012-3177

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-server-dos(79383)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:3.20
- cpe:/a:mysql:mysql:3.20.32a
- cpe:/a:mysql:mysql:3.21
- cpe:/a:mysql:mysql:3.22
- cpe:/a:mysql:mysql:3.22.26
- cpe:/a:mysql:mysql:3.22.27
- cpe:/a:mysql:mysql:3.22.28
- cpe:/a:mysql:mysql:3.22.29
- cpe:/a:mysql:mysql:3.22.30
- cpe:/a:mysql:mysql:3.22.32
- cpe:/a:mysql:mysql:3.23
- cpe:/a:mysql:mysql:3.23.0:alpha
- cpe:/a:mysql:mysql:3.23.1
- cpe:/a:mysql:mysql:3.23.2
- cpe:/a:mysql:mysql:3.23.3
- cpe:/a:mysql:mysql:3.23.4
- cpe:/a:mysql:mysql:3.23.5
- cpe:/a:mysql:mysql:3.23.6
- cpe:/a:mysql:mysql:3.23.7
- cpe:/a:mysql:mysql:3.23.8
- cpe:/a:mysql:mysql:3.23.9
- cpe:/a:mysql:mysql:3.23.10
- cpe:/a:mysql:mysql:3.23.11
- cpe:/a:mysql:mysql:3.23.12
- cpe:/a:mysql:mysql:3.23.13
- cpe:/a:mysql:mysql:3.23.14
- cpe:/a:mysql:mysql:3.23.15
- cpe:/a:mysql:mysql:3.23.16
- cpe:/a:mysql:mysql:3.23.17
- cpe:/a:mysql:mysql:3.23.18
- cpe:/a:mysql:mysql:3.23.19
- cpe:/a:mysql:mysql:3.23.20:beta
- cpe:/a:mysql:mysql:3.23.21
- cpe:/a:mysql:mysql:3.23.22
- cpe:/a:mysql:mysql:3.23.23
- cpe:/a:mysql:mysql:3.23.24
- cpe:/a:mysql:mysql:3.23.25
- cpe:/a:mysql:mysql:3.23.26
- cpe:/a:mysql:mysql:3.23.27
- cpe:/a:mysql:mysql:3.23.28
- cpe:/a:mysql:mysql:3.23.28:gamma
- cpe:/a:mysql:mysql:3.23.29
- cpe:/a:mysql:mysql:3.23.30
- cpe:/a:mysql:mysql:3.23.31
- cpe:/a:mysql:mysql:3.23.32
- cpe:/a:mysql:mysql:3.23.33
- cpe:/a:mysql:mysql:3.23.34
- cpe:/a:mysql:mysql:3.23.35
- cpe:/a:mysql:mysql:3.23.36
- cpe:/a:mysql:mysql:3.23.37
- cpe:/a:mysql:mysql:3.23.38
- cpe:/a:mysql:mysql:3.23.39
- cpe:/a:mysql:mysql:3.23.40
- cpe:/a:mysql:mysql:3.23.41
- cpe:/a:mysql:mysql:3.23.42
- cpe:/a:mysql:mysql:3.23.43
- cpe:/a:mysql:mysql:3.23.44
- cpe:/a:mysql:mysql:3.23.45
- cpe:/a:mysql:mysql:3.23.46
- cpe:/a:mysql:mysql:3.23.47
- cpe:/a:mysql:mysql:3.23.48
- cpe:/a:mysql:mysql:3.23.49
- cpe:/a:mysql:mysql:3.23.50
- cpe:/a:mysql:mysql:3.23.51
- cpe:/a:mysql:mysql:3.23.52
- cpe:/a:mysql:mysql:3.23.53
- cpe:/a:mysql:mysql:3.23.53a
- cpe:/a:mysql:mysql:3.23.54
- cpe:/a:mysql:mysql:3.23.54a
- cpe:/a:mysql:mysql:3.23.55
- cpe:/a:mysql:mysql:3.23.56
- cpe:/a:mysql:mysql:3.23.57
- cpe:/a:mysql:mysql:3.23.58
- cpe:/a:mysql:mysql:3.23.59
- cpe:/a:mysql:mysql:4.0.0
- cpe:/a:mysql:mysql:4.0.1
- cpe:/a:mysql:mysql:4.0.2
- cpe:/a:mysql:mysql:4.0.3
- cpe:/a:mysql:mysql:4.0.4
- cpe:/a:mysql:mysql:4.0.5
- cpe:/a:mysql:mysql:4.0.6
- cpe:/a:mysql:mysql:4.0.7
- cpe:/a:mysql:mysql:4.0.7:gamma
- cpe:/a:mysql:mysql:4.0.8
- cpe:/a:mysql:mysql:4.0.8:gamma
- cpe:/a:mysql:mysql:4.0.9
- cpe:/a:mysql:mysql:4.0.9:gamma
- cpe:/a:mysql:mysql:4.0.10
- cpe:/a:mysql:mysql:4.0.11
- cpe:/a:mysql:mysql:4.0.11:gamma
- cpe:/a:mysql:mysql:4.0.12
- cpe:/a:mysql:mysql:4.0.13
- cpe:/a:mysql:mysql:4.0.14
- cpe:/a:mysql:mysql:4.0.15
- cpe:/a:mysql:mysql:4.0.16
- cpe:/a:mysql:mysql:4.0.17
- cpe:/a:mysql:mysql:4.0.18
- cpe:/a:mysql:mysql:4.0.19
- cpe:/a:mysql:mysql:4.0.20
- cpe:/a:mysql:mysql:4.0.21
- cpe:/a:mysql:mysql:4.0.23
- cpe:/a:mysql:mysql:4.0.24
- cpe:/a:mysql:mysql:4.0.25
- cpe:/a:mysql:mysql:4.0.26
- cpe:/a:mysql:mysql:4.0.27
- cpe:/a:mysql:mysql:4.0.5a
- cpe:/a:mysql:mysql:4.1
- cpe:/a:mysql:mysql:4.1.0
- cpe:/a:mysql:mysql:4.1.0:alpha
- cpe:/a:mysql:mysql:4.1.0.0
- cpe:/a:mysql:mysql:4.1.1
- cpe:/a:mysql:mysql:4.1.2
- cpe:/a:mysql:mysql:4.1.2:alpha
- cpe:/a:mysql:mysql:4.1.3
- cpe:/a:mysql:mysql:4.1.3:beta
- cpe:/a:mysql:mysql:4.1.4
- cpe:/a:mysql:mysql:4.1.5
- cpe:/a:mysql:mysql:4.1.6
- cpe:/a:mysql:mysql:4.1.7
- cpe:/a:mysql:mysql:4.1.8
- cpe:/a:mysql:mysql:4.1.9
- cpe:/a:mysql:mysql:4.1.10
- cpe:/a:mysql:mysql:4.1.10a
- cpe:/a:mysql:mysql:4.1.11
- cpe:/a:mysql:mysql:4.1.12
- cpe:/a:mysql:mysql:4.1.12a
- cpe:/a:mysql:mysql:4.1.13
- cpe:/a:mysql:mysql:4.1.13a
- cpe:/a:mysql:mysql:4.1.14
- cpe:/a:mysql:mysql:4.1.14a
- cpe:/a:mysql:mysql:4.1.15
- cpe:/a:mysql:mysql:4.1.15a
- cpe:/a:mysql:mysql:4.1.16
- cpe:/a:mysql:mysql:4.1.17
- cpe:/a:mysql:mysql:4.1.18
- cpe:/a:mysql:mysql:4.1.19
- cpe:/a:mysql:mysql:4.1.20
- cpe:/a:mysql:mysql:4.1.21
- cpe:/a:mysql:mysql:4.1.22
- cpe:/a:mysql:mysql:4.1.8a
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27 and all previous versions

CVE-2012-3173

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB Plugin.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-innodbplugin-dos(79386)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a and all previous versions

CVE-2012-3167

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Full Text Search.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-serverfulltextsearch-dos(79392)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a and all previous versions

CVE-2012-3166

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:3.20
- cpe:/a:mysql:mysql:3.20.32a
- cpe:/a:mysql:mysql:3.21
- cpe:/a:mysql:mysql:3.22
- cpe:/a:mysql:mysql:3.22.26
- cpe:/a:mysql:mysql:3.22.27
- cpe:/a:mysql:mysql:3.22.28
- cpe:/a:mysql:mysql:3.22.29
- cpe:/a:mysql:mysql:3.22.30
- cpe:/a:mysql:mysql:3.22.32
- cpe:/a:mysql:mysql:3.23
- cpe:/a:mysql:mysql:3.23.0:alpha
- cpe:/a:mysql:mysql:3.23.1
- cpe:/a:mysql:mysql:3.23.2
- cpe:/a:mysql:mysql:3.23.3
- cpe:/a:mysql:mysql:3.23.4
- cpe:/a:mysql:mysql:3.23.5
- cpe:/a:mysql:mysql:3.23.6
- cpe:/a:mysql:mysql:3.23.7
- cpe:/a:mysql:mysql:3.23.8
- cpe:/a:mysql:mysql:3.23.9
- cpe:/a:mysql:mysql:3.23.10
- cpe:/a:mysql:mysql:3.23.11
- cpe:/a:mysql:mysql:3.23.12
- cpe:/a:mysql:mysql:3.23.13
- cpe:/a:mysql:mysql:3.23.14
- cpe:/a:mysql:mysql:3.23.15
- cpe:/a:mysql:mysql:3.23.16
- cpe:/a:mysql:mysql:3.23.17
- cpe:/a:mysql:mysql:3.23.18
- cpe:/a:mysql:mysql:3.23.19
- cpe:/a:mysql:mysql:3.23.20:beta
- cpe:/a:mysql:mysql:3.23.21
- cpe:/a:mysql:mysql:3.23.22
- cpe:/a:mysql:mysql:3.23.23
- cpe:/a:mysql:mysql:3.23.24
- cpe:/a:mysql:mysql:3.23.25
- cpe:/a:mysql:mysql:3.23.26
- cpe:/a:mysql:mysql:3.23.27
- cpe:/a:mysql:mysql:3.23.28
- cpe:/a:mysql:mysql:3.23.28:gamma
- cpe:/a:mysql:mysql:3.23.29
- cpe:/a:mysql:mysql:3.23.30
- cpe:/a:mysql:mysql:3.23.31
- cpe:/a:mysql:mysql:3.23.32
- cpe:/a:mysql:mysql:3.23.33
- cpe:/a:mysql:mysql:3.23.34
- cpe:/a:mysql:mysql:3.23.35
- cpe:/a:mysql:mysql:3.23.36
- cpe:/a:mysql:mysql:3.23.37
- cpe:/a:mysql:mysql:3.23.38
- cpe:/a:mysql:mysql:3.23.39
- cpe:/a:mysql:mysql:3.23.40
- cpe:/a:mysql:mysql:3.23.41
- cpe:/a:mysql:mysql:3.23.42
- cpe:/a:mysql:mysql:3.23.43
- cpe:/a:mysql:mysql:3.23.44
- cpe:/a:mysql:mysql:3.23.45
- cpe:/a:mysql:mysql:3.23.46
- cpe:/a:mysql:mysql:3.23.47
- cpe:/a:mysql:mysql:3.23.48
- cpe:/a:mysql:mysql:3.23.49
- cpe:/a:mysql:mysql:3.23.50
- cpe:/a:mysql:mysql:3.23.51
- cpe:/a:mysql:mysql:3.23.52
- cpe:/a:mysql:mysql:3.23.53
- cpe:/a:mysql:mysql:3.23.53a
- cpe:/a:mysql:mysql:3.23.54
- cpe:/a:mysql:mysql:3.23.54a
- cpe:/a:mysql:mysql:3.23.55
- cpe:/a:mysql:mysql:3.23.56
- cpe:/a:mysql:mysql:3.23.57
- cpe:/a:mysql:mysql:3.23.58
- cpe:/a:mysql:mysql:3.23.59
- cpe:/a:mysql:mysql:4.0.0
- cpe:/a:mysql:mysql:4.0.1
- cpe:/a:mysql:mysql:4.0.2
- cpe:/a:mysql:mysql:4.0.3
- cpe:/a:mysql:mysql:4.0.4
- cpe:/a:mysql:mysql:4.0.5
- cpe:/a:mysql:mysql:4.0.6
- cpe:/a:mysql:mysql:4.0.7
- cpe:/a:mysql:mysql:4.0.7:gamma
- cpe:/a:mysql:mysql:4.0.8
- cpe:/a:mysql:mysql:4.0.8:gamma
- cpe:/a:mysql:mysql:4.0.9
- cpe:/a:mysql:mysql:4.0.9:gamma
- cpe:/a:mysql:mysql:4.0.10
- cpe:/a:mysql:mysql:4.0.11
- cpe:/a:mysql:mysql:4.0.11:gamma
- cpe:/a:mysql:mysql:4.0.12
- cpe:/a:mysql:mysql:4.0.13
- cpe:/a:mysql:mysql:4.0.14
- cpe:/a:mysql:mysql:4.0.15
- cpe:/a:mysql:mysql:4.0.16
- cpe:/a:mysql:mysql:4.0.17
- cpe:/a:mysql:mysql:4.0.18
- cpe:/a:mysql:mysql:4.0.19
- cpe:/a:mysql:mysql:4.0.20
- cpe:/a:mysql:mysql:4.0.21
- cpe:/a:mysql:mysql:4.0.23
- cpe:/a:mysql:mysql:4.0.24
- cpe:/a:mysql:mysql:4.0.25
- cpe:/a:mysql:mysql:4.0.26
- cpe:/a:mysql:mysql:4.0.27
- cpe:/a:mysql:mysql:4.0.5a
- cpe:/a:mysql:mysql:4.1
- cpe:/a:mysql:mysql:4.1.0
- cpe:/a:mysql:mysql:4.1.0:alpha
- cpe:/a:mysql:mysql:4.1.0.0
- cpe:/a:mysql:mysql:4.1.1
- cpe:/a:mysql:mysql:4.1.2
- cpe:/a:mysql:mysql:4.1.2:alpha
- cpe:/a:mysql:mysql:4.1.3
- cpe:/a:mysql:mysql:4.1.3:beta
- cpe:/a:mysql:mysql:4.1.4
- cpe:/a:mysql:mysql:4.1.5
- cpe:/a:mysql:mysql:4.1.6
- cpe:/a:mysql:mysql:4.1.7
- cpe:/a:mysql:mysql:4.1.8
- cpe:/a:mysql:mysql:4.1.9
- cpe:/a:mysql:mysql:4.1.10
- cpe:/a:mysql:mysql:4.1.10a
- cpe:/a:mysql:mysql:4.1.11
- cpe:/a:mysql:mysql:4.1.12
- cpe:/a:mysql:mysql:4.1.12a
- cpe:/a:mysql:mysql:4.1.13
- cpe:/a:mysql:mysql:4.1.13a
- cpe:/a:mysql:mysql:4.1.14
- cpe:/a:mysql:mysql:4.1.14a
- cpe:/a:mysql:mysql:4.1.15
- cpe:/a:mysql:mysql:4.1.15a
- cpe:/a:mysql:mysql:4.1.16
- cpe:/a:mysql:mysql:4.1.17
- cpe:/a:mysql:mysql:4.1.18
- cpe:/a:mysql:mysql:4.1.19
- cpe:/a:mysql:mysql:4.1.20
- cpe:/a:mysql:mysql:4.1.21
- cpe:/a:mysql:mysql:4.1.22
- cpe:/a:mysql:mysql:4.1.8a
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63 and all previous versions
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a and all previous versions

CVE-2012-3163

Severity: High
CVSS Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.

- CONFIRM - http://support.f5.com/kb/en-us/solutions/public/14000/900/sol14907.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- SECUNIA - 56509
- SECUNIA - 56513
- UBUNTU - USN-1621-1
- XF - mysqlserver-informationschema-cve20123163(79381)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26 and all previous versions

CVE-2012-3160

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-serverinstallation-info-disc(79394)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:3.20
- cpe:/a:mysql:mysql:3.20.32a
- cpe:/a:mysql:mysql:3.21
- cpe:/a:mysql:mysql:3.22
- cpe:/a:mysql:mysql:3.22.26
- cpe:/a:mysql:mysql:3.22.27
- cpe:/a:mysql:mysql:3.22.28
- cpe:/a:mysql:mysql:3.22.29
- cpe:/a:mysql:mysql:3.22.30
- cpe:/a:mysql:mysql:3.22.32
- cpe:/a:mysql:mysql:3.23
- cpe:/a:mysql:mysql:3.23.0:alpha
- cpe:/a:mysql:mysql:3.23.1
- cpe:/a:mysql:mysql:3.23.2
- cpe:/a:mysql:mysql:3.23.3
- cpe:/a:mysql:mysql:3.23.4
- cpe:/a:mysql:mysql:3.23.5
- cpe:/a:mysql:mysql:3.23.6
- cpe:/a:mysql:mysql:3.23.7
- cpe:/a:mysql:mysql:3.23.8
- cpe:/a:mysql:mysql:3.23.9
- cpe:/a:mysql:mysql:3.23.10
- cpe:/a:mysql:mysql:3.23.11
- cpe:/a:mysql:mysql:3.23.12
- cpe:/a:mysql:mysql:3.23.13
- cpe:/a:mysql:mysql:3.23.14
- cpe:/a:mysql:mysql:3.23.15
- cpe:/a:mysql:mysql:3.23.16
- cpe:/a:mysql:mysql:3.23.17
- cpe:/a:mysql:mysql:3.23.18
- cpe:/a:mysql:mysql:3.23.19
- cpe:/a:mysql:mysql:3.23.20:beta
- cpe:/a:mysql:mysql:3.23.21
- cpe:/a:mysql:mysql:3.23.22
- cpe:/a:mysql:mysql:3.23.23
- cpe:/a:mysql:mysql:3.23.24
- cpe:/a:mysql:mysql:3.23.25
- cpe:/a:mysql:mysql:3.23.26
- cpe:/a:mysql:mysql:3.23.27
- cpe:/a:mysql:mysql:3.23.28
- cpe:/a:mysql:mysql:3.23.28:gamma
- cpe:/a:mysql:mysql:3.23.29
- cpe:/a:mysql:mysql:3.23.30
- cpe:/a:mysql:mysql:3.23.31
- cpe:/a:mysql:mysql:3.23.32
- cpe:/a:mysql:mysql:3.23.33
- cpe:/a:mysql:mysql:3.23.34
- cpe:/a:mysql:mysql:3.23.35
- cpe:/a:mysql:mysql:3.23.36
- cpe:/a:mysql:mysql:3.23.37
- cpe:/a:mysql:mysql:3.23.38
- cpe:/a:mysql:mysql:3.23.39
- cpe:/a:mysql:mysql:3.23.40
- cpe:/a:mysql:mysql:3.23.41
- cpe:/a:mysql:mysql:3.23.42
- cpe:/a:mysql:mysql:3.23.43
- cpe:/a:mysql:mysql:3.23.44
- cpe:/a:mysql:mysql:3.23.45
- cpe:/a:mysql:mysql:3.23.46
- cpe:/a:mysql:mysql:3.23.47
- cpe:/a:mysql:mysql:3.23.48
- cpe:/a:mysql:mysql:3.23.49
- cpe:/a:mysql:mysql:3.23.50
- cpe:/a:mysql:mysql:3.23.51
- cpe:/a:mysql:mysql:3.23.52
- cpe:/a:mysql:mysql:3.23.53
- cpe:/a:mysql:mysql:3.23.53a
- cpe:/a:mysql:mysql:3.23.54
- cpe:/a:mysql:mysql:3.23.54a
- cpe:/a:mysql:mysql:3.23.55
- cpe:/a:mysql:mysql:3.23.56
- cpe:/a:mysql:mysql:3.23.57
- cpe:/a:mysql:mysql:3.23.58
- cpe:/a:mysql:mysql:3.23.59
- cpe:/a:mysql:mysql:4.0.0
- cpe:/a:mysql:mysql:4.0.1
- cpe:/a:mysql:mysql:4.0.2
- cpe:/a:mysql:mysql:4.0.3
- cpe:/a:mysql:mysql:4.0.4
- cpe:/a:mysql:mysql:4.0.5
- cpe:/a:mysql:mysql:4.0.6
- cpe:/a:mysql:mysql:4.0.7
- cpe:/a:mysql:mysql:4.0.7:gamma
- cpe:/a:mysql:mysql:4.0.8
- cpe:/a:mysql:mysql:4.0.8:gamma
- cpe:/a:mysql:mysql:4.0.9
- cpe:/a:mysql:mysql:4.0.9:gamma
- cpe:/a:mysql:mysql:4.0.10
- cpe:/a:mysql:mysql:4.0.11
- cpe:/a:mysql:mysql:4.0.11:gamma
- cpe:/a:mysql:mysql:4.0.12
- cpe:/a:mysql:mysql:4.0.13
- cpe:/a:mysql:mysql:4.0.14
- cpe:/a:mysql:mysql:4.0.15
- cpe:/a:mysql:mysql:4.0.16
- cpe:/a:mysql:mysql:4.0.17
- cpe:/a:mysql:mysql:4.0.18
- cpe:/a:mysql:mysql:4.0.19
- cpe:/a:mysql:mysql:4.0.20
- cpe:/a:mysql:mysql:4.0.21
- cpe:/a:mysql:mysql:4.0.23
- cpe:/a:mysql:mysql:4.0.24
- cpe:/a:mysql:mysql:4.0.25
- cpe:/a:mysql:mysql:4.0.26
- cpe:/a:mysql:mysql:4.0.27
- cpe:/a:mysql:mysql:4.0.5a
- cpe:/a:mysql:mysql:4.1
- cpe:/a:mysql:mysql:4.1.0
- cpe:/a:mysql:mysql:4.1.0:alpha
- cpe:/a:mysql:mysql:4.1.0.0
- cpe:/a:mysql:mysql:4.1.1
- cpe:/a:mysql:mysql:4.1.2
- cpe:/a:mysql:mysql:4.1.2:alpha
- cpe:/a:mysql:mysql:4.1.3
- cpe:/a:mysql:mysql:4.1.3:beta
- cpe:/a:mysql:mysql:4.1.4
- cpe:/a:mysql:mysql:4.1.5
- cpe:/a:mysql:mysql:4.1.6
- cpe:/a:mysql:mysql:4.1.7
- cpe:/a:mysql:mysql:4.1.8
- cpe:/a:mysql:mysql:4.1.9
- cpe:/a:mysql:mysql:4.1.10
- cpe:/a:mysql:mysql:4.1.10a
- cpe:/a:mysql:mysql:4.1.11
- cpe:/a:mysql:mysql:4.1.12
- cpe:/a:mysql:mysql:4.1.12a
- cpe:/a:mysql:mysql:4.1.13
- cpe:/a:mysql:mysql:4.1.13a
- cpe:/a:mysql:mysql:4.1.14
- cpe:/a:mysql:mysql:4.1.14a
- cpe:/a:mysql:mysql:4.1.15
- cpe:/a:mysql:mysql:4.1.15a
- cpe:/a:mysql:mysql:4.1.16
- cpe:/a:mysql:mysql:4.1.17
- cpe:/a:mysql:mysql:4.1.18
- cpe:/a:mysql:mysql:4.1.19
- cpe:/a:mysql:mysql:4.1.20
- cpe:/a:mysql:mysql:4.1.21
- cpe:/a:mysql:mysql:4.1.22
- cpe:/a:mysql:mysql:4.1.8a
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27 and all previous versions

CVE-2012-3158

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Protocol.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:102
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-protocol-cve20123158(79382)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26 and all previous versions

CVE-2012-3150

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- DEBIAN - DSA-2581
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51177
- SECUNIA - 51309
- SECUNIA - 53372
- UBUNTU - USN-1621-1
- XF - mysqlserver-opt-dos(79388)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26 and all previous versions

CVE-2012-2749

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

MySQL 5.1.x before 5.1.63 and 5.5.x before 5.5.24 allows remote authenticated users to cause a denial of service (mysqld crash) via vectors related to incorrect calculation and a sort order index.

- BID - 55120
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-63.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=833737
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- REDHAT - RHSA-2013:0180
- SECUNIA - 51309
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23

CVE-2012-2102

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

MySQL 5.1.x before 5.1.62 and 5.5.x before 5.5.22 allows remote authenticated users to cause a denial of service (assertion failure and mysqld abort) by deleting a record and using HANDLER READ NEXT.

- BID - 52931
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-62.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-22.html
- GENTOO - GLSA-201308-06
- MISC - http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/3097.15.15
- MISC - http://eromang.zataz.com/2012/04/10/oracle-mysql-innodb-bugs-13510739-and-63775-dos-demo/
- MLIST - [oss-security] 20120413 Re: CVE request: mysql: Server crash on HANDLER READ NEXT after DELETE
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-1734

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- BID - 54540
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- OSVDB - 83979
- REDHAT - RHSA-2012:1462
- SECUNIA - 51309
- SECUNIA - 53372
- XF - mysql-servopt-dos(77064)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23 and all previous versions

CVE-2012-1705

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2012-1703

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:L/Au:S/C:N/I:N/A:C)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- BID - 53058
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 48890
- SECUNIA - 49179
- SECUNIA - 51309
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21 and all previous versions

CVE-2012-1702

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote attackers to affect availability via unknown vectors.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2012-1697

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition.

- BID - 53064
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- SECUNIA - 48890
- SECUNIA - 49179
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:3.20
- cpe:/a:mysql:mysql:3.20.32a
- cpe:/a:mysql:mysql:3.21
- cpe:/a:mysql:mysql:3.22
- cpe:/a:mysql:mysql:3.22.26
- cpe:/a:mysql:mysql:3.22.27
- cpe:/a:mysql:mysql:3.22.28
- cpe:/a:mysql:mysql:3.22.29
- cpe:/a:mysql:mysql:3.22.30
- cpe:/a:mysql:mysql:3.22.32
- cpe:/a:mysql:mysql:3.23
- cpe:/a:mysql:mysql:3.23.0:alpha
- cpe:/a:mysql:mysql:3.23.1
- cpe:/a:mysql:mysql:3.23.2
- cpe:/a:mysql:mysql:3.23.3
- cpe:/a:mysql:mysql:3.23.4
- cpe:/a:mysql:mysql:3.23.5
- cpe:/a:mysql:mysql:3.23.6
- cpe:/a:mysql:mysql:3.23.7
- cpe:/a:mysql:mysql:3.23.8
- cpe:/a:mysql:mysql:3.23.9
- cpe:/a:mysql:mysql:3.23.10
- cpe:/a:mysql:mysql:3.23.11
- cpe:/a:mysql:mysql:3.23.12
- cpe:/a:mysql:mysql:3.23.13
- cpe:/a:mysql:mysql:3.23.14
- cpe:/a:mysql:mysql:3.23.15
- cpe:/a:mysql:mysql:3.23.16
- cpe:/a:mysql:mysql:3.23.17
- cpe:/a:mysql:mysql:3.23.18
- cpe:/a:mysql:mysql:3.23.19
- cpe:/a:mysql:mysql:3.23.20:beta
- cpe:/a:mysql:mysql:3.23.21
- cpe:/a:mysql:mysql:3.23.22
- cpe:/a:mysql:mysql:3.23.23
- cpe:/a:mysql:mysql:3.23.24
- cpe:/a:mysql:mysql:3.23.25
- cpe:/a:mysql:mysql:3.23.26
- cpe:/a:mysql:mysql:3.23.27
- cpe:/a:mysql:mysql:3.23.28
- cpe:/a:mysql:mysql:3.23.28:gamma
- cpe:/a:mysql:mysql:3.23.29
- cpe:/a:mysql:mysql:3.23.30
- cpe:/a:mysql:mysql:3.23.31
- cpe:/a:mysql:mysql:3.23.32
- cpe:/a:mysql:mysql:3.23.33
- cpe:/a:mysql:mysql:3.23.34
- cpe:/a:mysql:mysql:3.23.35
- cpe:/a:mysql:mysql:3.23.36
- cpe:/a:mysql:mysql:3.23.37
- cpe:/a:mysql:mysql:3.23.38
- cpe:/a:mysql:mysql:3.23.39
- cpe:/a:mysql:mysql:3.23.40
- cpe:/a:mysql:mysql:3.23.41
- cpe:/a:mysql:mysql:3.23.42
- cpe:/a:mysql:mysql:3.23.43
- cpe:/a:mysql:mysql:3.23.44
- cpe:/a:mysql:mysql:3.23.45
- cpe:/a:mysql:mysql:3.23.46
- cpe:/a:mysql:mysql:3.23.47
- cpe:/a:mysql:mysql:3.23.48
- cpe:/a:mysql:mysql:3.23.49
- cpe:/a:mysql:mysql:3.23.50
- cpe:/a:mysql:mysql:3.23.51
- cpe:/a:mysql:mysql:3.23.52
- cpe:/a:mysql:mysql:3.23.53
- cpe:/a:mysql:mysql:3.23.53a
- cpe:/a:mysql:mysql:3.23.54
- cpe:/a:mysql:mysql:3.23.54a
- cpe:/a:mysql:mysql:3.23.55
- cpe:/a:mysql:mysql:3.23.56
- cpe:/a:mysql:mysql:3.23.57
- cpe:/a:mysql:mysql:3.23.58
- cpe:/a:mysql:mysql:3.23.59
- cpe:/a:mysql:mysql:4.0.0
- cpe:/a:mysql:mysql:4.0.1
- cpe:/a:mysql:mysql:4.0.2
- cpe:/a:mysql:mysql:4.0.3
- cpe:/a:mysql:mysql:4.0.4
- cpe:/a:mysql:mysql:4.0.5
- cpe:/a:mysql:mysql:4.0.6
- cpe:/a:mysql:mysql:4.0.7
- cpe:/a:mysql:mysql:4.0.7:gamma
- cpe:/a:mysql:mysql:4.0.8
- cpe:/a:mysql:mysql:4.0.8:gamma
- cpe:/a:mysql:mysql:4.0.9
- cpe:/a:mysql:mysql:4.0.9:gamma
- cpe:/a:mysql:mysql:4.0.10
- cpe:/a:mysql:mysql:4.0.11
- cpe:/a:mysql:mysql:4.0.11:gamma
- cpe:/a:mysql:mysql:4.0.12
- cpe:/a:mysql:mysql:4.0.13
- cpe:/a:mysql:mysql:4.0.14
- cpe:/a:mysql:mysql:4.0.15
- cpe:/a:mysql:mysql:4.0.16
- cpe:/a:mysql:mysql:4.0.17
- cpe:/a:mysql:mysql:4.0.18
- cpe:/a:mysql:mysql:4.0.19
- cpe:/a:mysql:mysql:4.0.20
- cpe:/a:mysql:mysql:4.0.21
- cpe:/a:mysql:mysql:4.0.23
- cpe:/a:mysql:mysql:4.0.24
- cpe:/a:mysql:mysql:4.0.25
- cpe:/a:mysql:mysql:4.0.26
- cpe:/a:mysql:mysql:4.0.27
- cpe:/a:mysql:mysql:4.0.5a
- cpe:/a:mysql:mysql:4.1
- cpe:/a:mysql:mysql:4.1.0
- cpe:/a:mysql:mysql:4.1.0:alpha
- cpe:/a:mysql:mysql:4.1.0.0
- cpe:/a:mysql:mysql:4.1.1
- cpe:/a:mysql:mysql:4.1.2
- cpe:/a:mysql:mysql:4.1.2:alpha
- cpe:/a:mysql:mysql:4.1.3
- cpe:/a:mysql:mysql:4.1.3:beta
- cpe:/a:mysql:mysql:4.1.4
- cpe:/a:mysql:mysql:4.1.5
- cpe:/a:mysql:mysql:4.1.6
- cpe:/a:mysql:mysql:4.1.7
- cpe:/a:mysql:mysql:4.1.8
- cpe:/a:mysql:mysql:4.1.9
- cpe:/a:mysql:mysql:4.1.10
- cpe:/a:mysql:mysql:4.1.10a
- cpe:/a:mysql:mysql:4.1.11
- cpe:/a:mysql:mysql:4.1.12
- cpe:/a:mysql:mysql:4.1.12a
- cpe:/a:mysql:mysql:4.1.13
- cpe:/a:mysql:mysql:4.1.13a
- cpe:/a:mysql:mysql:4.1.14
- cpe:/a:mysql:mysql:4.1.14a
- cpe:/a:mysql:mysql:4.1.15
- cpe:/a:mysql:mysql:4.1.15a
- cpe:/a:mysql:mysql:4.1.16
- cpe:/a:mysql:mysql:4.1.17
- cpe:/a:mysql:mysql:4.1.18
- cpe:/a:mysql:mysql:4.1.19
- cpe:/a:mysql:mysql:4.1.20
- cpe:/a:mysql:mysql:4.1.21
- cpe:/a:mysql:mysql:4.1.22
- cpe:/a:mysql:mysql:4.1.8a
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21 and all previous versions

CVE-2012-1696

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.19 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- BID - 53071
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- SECUNIA - 48890
- SECUNIA - 49179
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:3.20
- cpe:/a:mysql:mysql:3.20.32a
- cpe:/a:mysql:mysql:3.21
- cpe:/a:mysql:mysql:3.22
- cpe:/a:mysql:mysql:3.22.26
- cpe:/a:mysql:mysql:3.22.27
- cpe:/a:mysql:mysql:3.22.28
- cpe:/a:mysql:mysql:3.22.29
- cpe:/a:mysql:mysql:3.22.30
- cpe:/a:mysql:mysql:3.22.32
- cpe:/a:mysql:mysql:3.23
- cpe:/a:mysql:mysql:3.23.0:alpha
- cpe:/a:mysql:mysql:3.23.1
- cpe:/a:mysql:mysql:3.23.2
- cpe:/a:mysql:mysql:3.23.3
- cpe:/a:mysql:mysql:3.23.4
- cpe:/a:mysql:mysql:3.23.5
- cpe:/a:mysql:mysql:3.23.6
- cpe:/a:mysql:mysql:3.23.7
- cpe:/a:mysql:mysql:3.23.8
- cpe:/a:mysql:mysql:3.23.9
- cpe:/a:mysql:mysql:3.23.10
- cpe:/a:mysql:mysql:3.23.11
- cpe:/a:mysql:mysql:3.23.12
- cpe:/a:mysql:mysql:3.23.13
- cpe:/a:mysql:mysql:3.23.14
- cpe:/a:mysql:mysql:3.23.15
- cpe:/a:mysql:mysql:3.23.16
- cpe:/a:mysql:mysql:3.23.17
- cpe:/a:mysql:mysql:3.23.18
- cpe:/a:mysql:mysql:3.23.19
- cpe:/a:mysql:mysql:3.23.20:beta
- cpe:/a:mysql:mysql:3.23.21
- cpe:/a:mysql:mysql:3.23.22
- cpe:/a:mysql:mysql:3.23.23
- cpe:/a:mysql:mysql:3.23.24
- cpe:/a:mysql:mysql:3.23.25
- cpe:/a:mysql:mysql:3.23.26
- cpe:/a:mysql:mysql:3.23.27
- cpe:/a:mysql:mysql:3.23.28
- cpe:/a:mysql:mysql:3.23.28:gamma
- cpe:/a:mysql:mysql:3.23.29
- cpe:/a:mysql:mysql:3.23.30
- cpe:/a:mysql:mysql:3.23.31
- cpe:/a:mysql:mysql:3.23.32
- cpe:/a:mysql:mysql:3.23.33
- cpe:/a:mysql:mysql:3.23.34
- cpe:/a:mysql:mysql:3.23.35
- cpe:/a:mysql:mysql:3.23.36
- cpe:/a:mysql:mysql:3.23.37
- cpe:/a:mysql:mysql:3.23.38
- cpe:/a:mysql:mysql:3.23.39
- cpe:/a:mysql:mysql:3.23.40
- cpe:/a:mysql:mysql:3.23.41
- cpe:/a:mysql:mysql:3.23.42
- cpe:/a:mysql:mysql:3.23.43
- cpe:/a:mysql:mysql:3.23.44
- cpe:/a:mysql:mysql:3.23.45
- cpe:/a:mysql:mysql:3.23.46
- cpe:/a:mysql:mysql:3.23.47
- cpe:/a:mysql:mysql:3.23.48
- cpe:/a:mysql:mysql:3.23.49
- cpe:/a:mysql:mysql:3.23.50
- cpe:/a:mysql:mysql:3.23.51
- cpe:/a:mysql:mysql:3.23.52
- cpe:/a:mysql:mysql:3.23.53
- cpe:/a:mysql:mysql:3.23.53a
- cpe:/a:mysql:mysql:3.23.54
- cpe:/a:mysql:mysql:3.23.54a
- cpe:/a:mysql:mysql:3.23.55
- cpe:/a:mysql:mysql:3.23.56
- cpe:/a:mysql:mysql:3.23.57
- cpe:/a:mysql:mysql:3.23.58
- cpe:/a:mysql:mysql:3.23.59
- cpe:/a:mysql:mysql:4.0.0
- cpe:/a:mysql:mysql:4.0.1
- cpe:/a:mysql:mysql:4.0.2
- cpe:/a:mysql:mysql:4.0.3
- cpe:/a:mysql:mysql:4.0.4
- cpe:/a:mysql:mysql:4.0.5
- cpe:/a:mysql:mysql:4.0.6
- cpe:/a:mysql:mysql:4.0.7
- cpe:/a:mysql:mysql:4.0.7:gamma
- cpe:/a:mysql:mysql:4.0.8
- cpe:/a:mysql:mysql:4.0.8:gamma
- cpe:/a:mysql:mysql:4.0.9
- cpe:/a:mysql:mysql:4.0.9:gamma
- cpe:/a:mysql:mysql:4.0.10
- cpe:/a:mysql:mysql:4.0.11
- cpe:/a:mysql:mysql:4.0.11:gamma
- cpe:/a:mysql:mysql:4.0.12
- cpe:/a:mysql:mysql:4.0.13
- cpe:/a:mysql:mysql:4.0.14
- cpe:/a:mysql:mysql:4.0.15
- cpe:/a:mysql:mysql:4.0.16
- cpe:/a:mysql:mysql:4.0.17
- cpe:/a:mysql:mysql:4.0.18
- cpe:/a:mysql:mysql:4.0.19
- cpe:/a:mysql:mysql:4.0.20
- cpe:/a:mysql:mysql:4.0.21
- cpe:/a:mysql:mysql:4.0.23
- cpe:/a:mysql:mysql:4.0.24
- cpe:/a:mysql:mysql:4.0.25
- cpe:/a:mysql:mysql:4.0.26
- cpe:/a:mysql:mysql:4.0.27
- cpe:/a:mysql:mysql:4.0.5a
- cpe:/a:mysql:mysql:4.1
- cpe:/a:mysql:mysql:4.1.0
- cpe:/a:mysql:mysql:4.1.0:alpha
- cpe:/a:mysql:mysql:4.1.0.0
- cpe:/a:mysql:mysql:4.1.1
- cpe:/a:mysql:mysql:4.1.2
- cpe:/a:mysql:mysql:4.1.2:alpha
- cpe:/a:mysql:mysql:4.1.3
- cpe:/a:mysql:mysql:4.1.3:beta
- cpe:/a:mysql:mysql:4.1.4
- cpe:/a:mysql:mysql:4.1.5
- cpe:/a:mysql:mysql:4.1.6
- cpe:/a:mysql:mysql:4.1.7
- cpe:/a:mysql:mysql:4.1.8
- cpe:/a:mysql:mysql:4.1.9
- cpe:/a:mysql:mysql:4.1.10
- cpe:/a:mysql:mysql:4.1.10a
- cpe:/a:mysql:mysql:4.1.11
- cpe:/a:mysql:mysql:4.1.12
- cpe:/a:mysql:mysql:4.1.12a
- cpe:/a:mysql:mysql:4.1.13
- cpe:/a:mysql:mysql:4.1.13a
- cpe:/a:mysql:mysql:4.1.14
- cpe:/a:mysql:mysql:4.1.14a
- cpe:/a:mysql:mysql:4.1.15
- cpe:/a:mysql:mysql:4.1.15a
- cpe:/a:mysql:mysql:4.1.16
- cpe:/a:mysql:mysql:4.1.17
- cpe:/a:mysql:mysql:4.1.18
- cpe:/a:mysql:mysql:4.1.19
- cpe:/a:mysql:mysql:4.1.20
- cpe:/a:mysql:mysql:4.1.21
- cpe:/a:mysql:mysql:4.1.22
- cpe:/a:mysql:mysql:4.1.8a
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:mysql:mysql_community_server:5.1.1
- cpe:/a:mysql:mysql_community_server:5.1.2
- cpe:/a:mysql:mysql_community_server:5.1.3
- cpe:/a:mysql:mysql_community_server:5.1.4
- cpe:/a:mysql:mysql_community_server:5.1.5
- cpe:/a:mysql:mysql_community_server:5.1.6
- cpe:/a:mysql:mysql_community_server:5.1.7
- cpe:/a:mysql:mysql_community_server:5.1.8
- cpe:/a:mysql:mysql_community_server:5.1.9
- cpe:/a:mysql:mysql_community_server:5.1.10
- cpe:/a:mysql:mysql_community_server:5.1.11
- cpe:/a:mysql:mysql_community_server:5.1.12
- cpe:/a:mysql:mysql_community_server:5.1.13
- cpe:/a:mysql:mysql_community_server:5.1.14
- cpe:/a:mysql:mysql_community_server:5.1.15
- cpe:/a:mysql:mysql_community_server:5.1.16
- cpe:/a:mysql:mysql_community_server:5.1.17
- cpe:/a:mysql:mysql_community_server:5.1.18
- cpe:/a:mysql:mysql_community_server:5.1.19
- cpe:/a:mysql:mysql_community_server:5.1.20
- cpe:/a:mysql:mysql_community_server:5.1.21
- cpe:/a:mysql:mysql_community_server:5.1.22
- cpe:/a:mysql:mysql_server:5.1.22
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19 and all previous versions
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:sun:mysql_connector%2fj:5.1.8

CVE-2012-1690

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- BID - 53074
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 48890
- SECUNIA - 49179
- SECUNIA - 51309
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60 and all previous versions
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21 and all previous versions

CVE-2012-1689

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

- BID - 54547
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- OSVDB - 83980
- REDHAT - RHSA-2012:1462
- SECUNIA - 51309
- SECUNIA - 53372
- XF - mysql-optimizer-dos(77065)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22

CVE-2012-1688

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability, related to Server DML.

- BID - 53067
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 48890
- SECUNIA - 49179
- SECUNIA - 51309
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60 and all previous versions
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21 and all previous versions

CVE-2012-0882

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.

- MISC - https://blogs.oracle.com/sunsecurity/entry/cve_2012_0882buffer_overflow_vulnerability
- MISC - https://bugzilla.redhat.com/show_bug.cgi?id=789141
- MLIST - [Canvas] 20120207 VulnDisco Pack Professional 9.17
- MLIST - [Canvas] 20120223 VulnDisco MySQL 0day
- MLIST - [oss-security] 20120224 Re: MySQL 0-day - does it need a CVE?

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0583

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.60 and earlier, and 5.5.19 and earlier, allows remote authenticated users to affect availability, related to MyISAM.

- BID - 53061
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- SECUNIA - 48890
- SECUNIA - 49179
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60 and all previous versions
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19 and all previous versions

CVE-2012-0574

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- HP - HPSBUX02824
- HP - SSRT100970
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2012-0572

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2013:0219
- SECUNIA - 53372
- UBUNTU - USN-1703-1

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28 and all previous versions

CVE-2012-0553

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492.

- CONFIRM - https://blogs.oracle.com/sunsecurity/entry/cve_2012_0553_buffer_overflow
- GENTOO - GLSA-201308-06
- MISC - http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html
- SECUNIA - 52445
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.1.66
- cpe:/a:oracle:mysql:5.1.67
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27

CVE-2012-0540

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier and 5.5.23 and earlier allows remote authenticated users to affect availability, related to GIS Extension.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- GENTOO - GLSA-201308-06
- MANDRIVA - MDVSA-2013:150
- REDHAT - RHSA-2012:1462
- SECUNIA - 51309
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62 and all previous versions
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23 and all previous versions

CVE-2012-0492

Severity: Low
CVSS Score: 2.1 (AV:N/AC:H/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0485.

- BID - 51516
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78393
- SECUNIA - 53372
- XF - mysql-serveruns14-dos(72537)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0490

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect availability via unknown vectors.

- BID - 51524
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78388
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984
- XF - mysql-serveruns9-dos(72531)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0485

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0492.

- BID - 51513
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78383
- SECUNIA - 53372
- XF - mysql-serveruns4-dos(72526)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0484

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect confidentiality via unknown vectors.

- BID - 51515
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78372
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984
- XF - mysql-server-info-disc(72525)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0120

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0485, and CVE-2012-0492.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0119

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0118

Severity: Medium
CVSS Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0113.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0116

Severity: Medium
CVSS Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0115

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0114

Severity: Low
CVSS Score: 3.0 (AV:L/AC:M/Au:S/C:P/I:P/A:N)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows local users to affect confidentiality and integrity via unknown vectors.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0113

Severity: Medium
CVSS Score: 5.5 (AV:N/AC:L/Au:S/C:P/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0118.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0112

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2012-0102

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0101.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78379
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984
- XF - mysql-serveruns2-dos(72521)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61

CVE-2012-0101

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0102.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78378
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984
- XF - mysql-serveruns1-dos(72520)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61

CVE-2012-0087

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0101 and CVE-2012-0102.

- BID - 51509
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78377
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984
- XF - mysql-serveruns-dos(72519)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61

CVE-2012-0075

Severity: Low
CVSS Score: 1.7 (AV:N/AC:H/Au:M/C:N/I:P/A:N)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect integrity via unknown vectors.

- BID - 51526
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- OSVDB - 78374
- SECUNIA - 53372
- SUSE - SUSE-SU-2012:0984
- XF - mysql-server-cve20120075(72539)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.0.93
- cpe:/a:mysql:mysql:5.0.94
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.5.1
- cpe:/a:oracle:mysql:5.5.2
- cpe:/a:oracle:mysql:5.5.3
- cpe:/a:oracle:mysql:5.5.4
- cpe:/a:oracle:mysql:5.5.5
- cpe:/a:oracle:mysql:5.5.6
- cpe:/a:oracle:mysql:5.5.7
- cpe:/a:oracle:mysql:5.5.8
- cpe:/a:oracle:mysql:5.5.9
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21

CVE-2011-2262

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote attackers to affect availability via unknown vectors.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- GENTOO - GLSA-201308-06
- SECUNIA - 53372

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5
- cpe:/a:mysql:mysql:5.5.6
- cpe:/a:mysql:mysql:5.5.7
- cpe:/a:mysql:mysql:5.5.8
- cpe:/a:mysql:mysql:5.5.9
- cpe:/a:oracle:mysql:5.1.51
- cpe:/a:oracle:mysql:5.1.52
- cpe:/a:oracle:mysql:5.1.52:sp1
- cpe:/a:oracle:mysql:5.1.53
- cpe:/a:oracle:mysql:5.1.54
- cpe:/a:oracle:mysql:5.1.55
- cpe:/a:oracle:mysql:5.1.56
- cpe:/a:oracle:mysql:5.1.57
- cpe:/a:oracle:mysql:5.1.58
- cpe:/a:oracle:mysql:5.1.59
- cpe:/a:oracle:mysql:5.1.60
- cpe:/a:oracle:mysql:5.1.61
- cpe:/a:oracle:mysql:5.1.62
- cpe:/a:oracle:mysql:5.1.63
- cpe:/a:oracle:mysql:5.1.64
- cpe:/a:oracle:mysql:5.1.65
- cpe:/a:oracle:mysql:5.5.10
- cpe:/a:oracle:mysql:5.5.11
- cpe:/a:oracle:mysql:5.5.12
- cpe:/a:oracle:mysql:5.5.13
- cpe:/a:oracle:mysql:5.5.14
- cpe:/a:oracle:mysql:5.5.15
- cpe:/a:oracle:mysql:5.5.16
- cpe:/a:oracle:mysql:5.5.17
- cpe:/a:oracle:mysql:5.5.18
- cpe:/a:oracle:mysql:5.5.19
- cpe:/a:oracle:mysql:5.5.20
- cpe:/a:oracle:mysql:5.5.21
- cpe:/a:oracle:mysql:5.5.22
- cpe:/a:oracle:mysql:5.5.23
- cpe:/a:oracle:mysql:5.5.24
- cpe:/a:oracle:mysql:5.5.25
- cpe:/a:oracle:mysql:5.5.25:a
- cpe:/a:oracle:mysql:5.5.26
- cpe:/a:oracle:mysql:5.5.27
- cpe:/a:oracle:mysql:5.5.28

CVE-2010-3840

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with Well-Known Binary (WKB) data containing a crafted number of (1) line strings or (2) line points.

- BID - 43676
- CONFIRM - http://bugs.mysql.com/bug.php?id=51875
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640865
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- MISC - http://lists.mysql.com/commits/117094
- REDHAT - RHSA-2010:0824
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-gislinestringinitfromwkb-dos(64838)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-3839

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that creates a query with nested JOIN statements.

- BID - 43676
- CONFIRM - http://bugs.mysql.com/bug.php?id=53544
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640861
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42936
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0170
- XF - mysql-invocations-dos(64839)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3838

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result is "processed using an intermediate temporary table."

- APPLE - APPLE-SA-2011-06-23-1
- BID - 43676
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640858
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- MISC - http://bugs.mysql.com/bug.php?id=54461
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-longblob-dos(64840)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3837

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a prepared statement that uses GROUP_CONCAT with the WITH ROLLUP modifier, probably triggering a use-after-free error when a copied object is modified in a way that also affects the original object.

- APPLE - APPLE-SA-2011-06-23-1
- BID - 43676
- CONFIRM - http://bugs.mysql.com/bug.php?id=54476
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640856
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-prepared-statement-dos(64841)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3836

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (assertion failure and server crash) via vectors related to view preparation, pre-evaluation of LIKE predicates, and IN Optimizers.

- APPLE - APPLE-SA-2011-06-23-1
- BID - 43676
- CONFIRM - http://bugs.mysql.com/bug.php?id=54568
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640845
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-view-preparation-dos(64842)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3835

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-189 Numeric Errors

MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (mysqld server crash) by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY, then causing the expression value to be used after the table is created, which causes the expression to be re-evaluated instead of accessing its value from the table.

- APPLE - APPLE-SA-2011-06-23-1
- BID - 43676
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640819
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- MISC - http://bugs.mysql.com/bug.php?id=55564
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-uservariable-dos(64843)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3834

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via vectors related to "materializing a derived table that required a temporary table for grouping" and "user variable assignments."

- APPLE - APPLE-SA-2011-06-23-1
- BID - 43676
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640808
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- MISC - http://bugs.mysql.com/bug.php?id=55568
- SECUNIA - 42875
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0345
- XF - mysql-derived-table-dos(64844)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3833

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 does not properly propagate type errors, which allows remote attackers to cause a denial of service (server crash) via crafted arguments to extreme-value functions such as (1) LEAST and (2) GREATEST, related to KILL_BAD_DATA and a "CREATE TABLE ... SELECT."

- APPLE - APPLE-SA-2011-06-23-1
- BID - 43676
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640751
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2010:223
- MISC - http://bugs.mysql.com/bug.php?id=55826
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-extremevalue-dos(64845)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1
- cpe:/a:mysql:mysql:5.1.50
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4
- cpe:/a:mysql:mysql:5.5.5

CVE-2010-3683

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request.

- BID - 42625
- CONFIRM - http://bugs.mysql.com/bug.php?id=52512
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-5.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628698
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2011:0164
- SECUNIA - 42936
- SUSE - SUSE-SR:2010:019
- SUSE - SUSE-SR:2010:021
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170
- XF - mysql-ok-packet-dos(64683)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4

CVE-2010-3682

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function.

- APPLE - APPLE-SA-2011-06-23-1
- BID - 42599
- CONFIRM - http://bugs.mysql.com/bug.php?id=52711
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628328
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- SUSE - SUSE-SR:2010:019
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-itemsinglerowsubselect-dos(64684)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.28
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.34
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.36:sp1
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.40
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.44:sp1
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.46
- cpe:/a:mysql:mysql:5.0.48
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51:a
- cpe:/a:mysql:mysql:5.0.51:b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.56:sp1
- cpe:/a:mysql:mysql:5.0.58
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.62
- cpe:/a:mysql:mysql:5.0.64
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.66:a
- cpe:/a:mysql:mysql:5.0.66:sp1
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.68
- cpe:/a:mysql:mysql:5.0.70
- cpe:/a:mysql:mysql:5.0.72
- cpe:/a:mysql:mysql:5.0.72:sp1
- cpe:/a:mysql:mysql:5.0.74
- cpe:/a:mysql:mysql:5.0.74:sp1
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.76
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.78
- cpe:/a:mysql:mysql:5.0.79
- cpe:/a:mysql:mysql:5.0.80
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.82:sp1
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.84:sp1
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.87:sp1
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91 and all previous versions
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48 and all previous versions

CVE-2010-3681

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing "alternate reads from two indexes on a table," which triggers an assertion failure.

- BID - 42633
- CONFIRM - http://bugs.mysql.com/bug.php?id=54007
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-5.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628680
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2010:0824
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- SUSE - SUSE-SR:2010:019
- SUSE - SUSE-SR:2010:021
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-handler-interface-dos(64685)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.5a
- cpe:/a:mysql:mysql:5.5.0
- cpe:/a:mysql:mysql:5.5.1
- cpe:/a:mysql:mysql:5.5.2
- cpe:/a:mysql:mysql:5.5.3
- cpe:/a:mysql:mysql:5.5.4

CVE-2010-3680

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an assertion failure.

- BID - 42598
- CONFIRM - http://bugs.mysql.com/bug.php?id=54044
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628192
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-innodb-dos(64686)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-3679

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized memory, as demonstrated by valgrind.

- BID - 42638
- CONFIRM - http://bugs.mysql.com/bug.php?id=54393
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628062
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2011:0164
- SECUNIA - 42936
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170
- XF - mysql-binlog-command-dos(64687)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-3678

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.

- BID - 42596
- CONFIRM - http://bugs.mysql.com/bug.php?id=54477
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628172
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2011:0164
- SECUNIA - 42936
- SUSE - SUSE-SR:2010:019
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-3677

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.

- APPLE - APPLE-SA-2011-06-23-1
- BID - 42646
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - http://support.apple.com/kb/HT4723
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628040
- DEBIAN - DSA-2143
- MANDRIVA - MDVSA-2010:155
- MANDRIVA - MDVSA-2010:222
- MANDRIVA - MDVSA-2011:012
- MISC - http://bugs.mysql.com/bug.php?id=54575
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- REDHAT - RHSA-2010:0825
- REDHAT - RHSA-2011:0164
- SECUNIA - 42875
- SECUNIA - 42936
- SUSE - SUSE-SR:2010:019
- TURBO - TLSA-2011-3
- UBUNTU - USN-1017-1
- VUPEN - ADV-2011-0105
- VUPEN - ADV-2011-0133
- VUPEN - ADV-2011-0170
- VUPEN - ADV-2011-0345
- XF - mysql-setcolumn-dos(64688)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.28
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.34
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.36:sp1
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.40
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.44:sp1
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.46
- cpe:/a:mysql:mysql:5.0.48
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51:a
- cpe:/a:mysql:mysql:5.0.51:b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.56:sp1
- cpe:/a:mysql:mysql:5.0.58
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.62
- cpe:/a:mysql:mysql:5.0.64
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.66:a
- cpe:/a:mysql:mysql:5.0.66:sp1
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.68
- cpe:/a:mysql:mysql:5.0.70
- cpe:/a:mysql:mysql:5.0.72
- cpe:/a:mysql:mysql:5.0.72:sp1
- cpe:/a:mysql:mysql:5.0.74
- cpe:/a:mysql:mysql:5.0.74:sp1
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.76
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.78
- cpe:/a:mysql:mysql:5.0.79
- cpe:/a:mysql:mysql:5.0.80
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.82:sp1
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.84:sp1
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.87:sp1
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91 and all previous versions
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48 and all previous versions

CVE-2010-3676

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement.

- BID - 42643
- CONFIRM - http://bugs.mysql.com/bug.php?id=55039
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=628660
- MANDRIVA - MDVSA-2011:012
- MLIST - [oss-security] 20100928 Re: CVE Request -- MySQL v5.1.49 -- multiple DoS flaws
- VUPEN - ADV-2011-0133
- XF - mysql-dictocrea-dos(64689)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-2008

Severity: Low
CVSS Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation

MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.

- BID - 41198
- CONFIRM - http://bugs.mysql.com/bug.php?id=53804
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-48.html
- FEDORA - FEDORA-2010-11135
- MANDRIVA - MDVSA-2010:155
- SECTRACK - 1024160
- SECUNIA - 40333
- SECUNIA - 40762
- UBUNTU - USN-1017-1
- VUPEN - ADV-2010-1918

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47 and all previous versions
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-1626

Severity: Low
CVSS Score: 3.6 (AV:L/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.

- BID - 40257
- CONFIRM - http://bugs.mysql.com/bug.php?id=40980
- MANDRIVA - MDVSA-2010:101
- MLIST - [oss-security] 20100510 Re: A mysql flaw.
- MLIST - [oss-security] 20100518 Re: A mysql flaw.
- REDHAT - RHSA-2010:0442
- SECTRACK - 1024004
- SUSE - SUSE-SR:2010:019
- SUSE - SUSE-SR:2010:021
- VUPEN - ADV-2010-1194

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.45 and all previous versions
- ...
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45b
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45 and all previous versions
- cpe:/a:mysql:mysql:5.1.5a

CVE-2010-1621

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The mysql_uninstall_plugin function in sql/sql_plugin.cc in MySQL 5.1 before 5.1.46 does not check privileges before uninstalling a plugin, which allows remote attackers to uninstall arbitrary plugins via the UNINSTALL PLUGIN command.

- BID - 39543
- CONFIRM - http://bugs.mysql.com/bug.php?id=51770
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html
- MANDRIVA - MDVSA-2010:093

Vulnerable Software & Versions:

- cpe:/a:mysql:mysql:5.1.45 and all previous versions

CVE-2009-5026

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.

- CONFIRM - http://bugs.mysql.com/bug.php?id=49124
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=640177
- MLIST - [oss-security] 20111018 Re: MySQL executable comment execution on MySQL slave server (from 2009)
- SECUNIA - 49179
- SUSE - SUSE-SU-2012:0984

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.45:b
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.67
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87
- cpe:/a:mysql:mysql:5.0.88
- cpe:/a:mysql:mysql:5.0.89
- cpe:/a:mysql:mysql:5.0.90
- cpe:/a:mysql:mysql:5.0.91
- cpe:/a:mysql:mysql:5.0.92
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.41
- cpe:/a:mysql:mysql:5.1.42
- cpe:/a:mysql:mysql:5.1.43
- cpe:/a:mysql:mysql:5.1.43:sp1
- cpe:/a:mysql:mysql:5.1.44
- cpe:/a:mysql:mysql:5.1.45
- cpe:/a:mysql:mysql:5.1.46
- cpe:/a:mysql:mysql:5.1.46:sp1
- cpe:/a:mysql:mysql:5.1.47
- cpe:/a:mysql:mysql:5.1.48
- cpe:/a:mysql:mysql:5.1.49
- cpe:/a:mysql:mysql:5.1.49:sp1

CVE-2009-4028

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

- CONFIRM - http://bugs.mysql.com/47320
- CONFIRM - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
- MLIST - [commits] 20091020 bzr commit into mysql-4.1 branch (joro:2709) Bug#47320
- MLIST - [oss-security] 20091119 mysql-5.1.41
- MLIST - [oss-security] 20091121 CVE Request - MySQL - 5.0.88
- MLIST - [oss-security] 20091123 Re: mysql-5.1.41
- REDHAT - RHSA-2010:0109
- SUSE - SUSE-SR:2010:011
- VUPEN - ADV-2010-1107

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.26
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b
- cpe:/a:mysql:mysql:5.0.52
- cpe:/a:mysql:mysql:5.0.54
- cpe:/a:mysql:mysql:5.0.56
- cpe:/a:mysql:mysql:5.0.60
- cpe:/a:mysql:mysql:5.0.66
- cpe:/a:mysql:mysql:5.0.75
- cpe:/a:mysql:mysql:5.0.77
- cpe:/a:mysql:mysql:5.0.81
- cpe:/a:mysql:mysql:5.0.82
- cpe:/a:mysql:mysql:5.0.83
- cpe:/a:mysql:mysql:5.0.84
- cpe:/a:mysql:mysql:5.0.85
- cpe:/a:mysql:mysql:5.0.86
- cpe:/a:mysql:mysql:5.0.87 and all previous versions
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.4
- cpe:/a:mysql:mysql:5.1.5
- cpe:/a:mysql:mysql:5.1.6
- cpe:/a:mysql:mysql:5.1.7
- cpe:/a:mysql:mysql:5.1.8
- cpe:/a:mysql:mysql:5.1.9
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32
- cpe:/a:mysql:mysql:5.1.32-bzr
- cpe:/a:mysql:mysql:5.1.33
- cpe:/a:mysql:mysql:5.1.34
- cpe:/a:mysql:mysql:5.1.34:sp1
- cpe:/a:mysql:mysql:5.1.35
- cpe:/a:mysql:mysql:5.1.36
- cpe:/a:mysql:mysql:5.1.37
- cpe:/a:mysql:mysql:5.1.37:sp1
- cpe:/a:mysql:mysql:5.1.38
- cpe:/a:mysql:mysql:5.1.39
- cpe:/a:mysql:mysql:5.1.40
- cpe:/a:mysql:mysql:5.1.40:sp1
- cpe:/a:mysql:mysql:5.1.5a

CVE-2009-0819

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.

- BID - 33972
- CONFIRM - http://bugs.mysql.com/bug.php?id=42495
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html
- CONFIRM - http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html
- SECTRACK - 1021786
- SECUNIA - 34115
- VUPEN - ADV-2009-0594
- XF - mysql-xpath-dos(49050)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql:5.1.27
- ...
- cpe:/a:mysql:mysql:5.1
- cpe:/a:mysql:mysql:5.1.1
- cpe:/a:mysql:mysql:5.1.2
- cpe:/a:mysql:mysql:5.1.10
- cpe:/a:mysql:mysql:5.1.11
- cpe:/a:mysql:mysql:5.1.12
- cpe:/a:mysql:mysql:5.1.13
- cpe:/a:mysql:mysql:5.1.14
- cpe:/a:mysql:mysql:5.1.15
- cpe:/a:mysql:mysql:5.1.16
- cpe:/a:mysql:mysql:5.1.17
- cpe:/a:mysql:mysql:5.1.18
- cpe:/a:mysql:mysql:5.1.19
- cpe:/a:mysql:mysql:5.1.20
- cpe:/a:mysql:mysql:5.1.21
- cpe:/a:mysql:mysql:5.1.22
- cpe:/a:mysql:mysql:5.1.23
- cpe:/a:mysql:mysql:5.1.23:a
- cpe:/a:mysql:mysql:5.1.23_bk
- cpe:/a:mysql:mysql:5.1.23a
- cpe:/a:mysql:mysql:5.1.3
- cpe:/a:mysql:mysql:5.1.24
- cpe:/a:mysql:mysql:5.1.25
- cpe:/a:mysql:mysql:5.1.26
- cpe:/a:mysql:mysql:5.1.27
- cpe:/a:mysql:mysql:5.1.28
- cpe:/a:mysql:mysql:5.1.29
- cpe:/a:mysql:mysql:5.1.30
- cpe:/a:mysql:mysql:5.1.31
- cpe:/a:mysql:mysql:5.1.31:sp1
- cpe:/a:mysql:mysql:5.1.32-bzr and all previous versions
- cpe:/a:mysql:mysql:6.0.0
- cpe:/a:mysql:mysql:6.0.1
- cpe:/a:mysql:mysql:6.0.2
- cpe:/a:mysql:mysql:6.0.3
- cpe:/a:mysql:mysql:6.0.4
- cpe:/a:mysql:mysql:6.0.9
- cpe:/a:mysql:mysql:6.0.10-bzr

CVE-2008-4098

Severity: Medium
CVSS Score: 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

- CONFIRM - http://bugs.mysql.com/bug.php?id=32167
- DEBIAN - DSA-1662
- MANDRIVA - MDVSA-2009:094
- MISC - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25
- MLIST - [oss-security] 20080909 Re: CVE request: MySQL incomplete fix for CVE-2008-2079
- MLIST - [oss-security] 20080916 Re: CVE request: MySQL incomplete fix for CVE-2008-2079
- REDHAT - RHSA-2009:1067
- REDHAT - RHSA-2010:0110
- SECUNIA - 32578
- SECUNIA - 32759
- SECUNIA - 32769
- SECUNIA - 38517
- SUSE - SUSE-SR:2008:025
- UBUNTU - USN-671-1
- UBUNTU - USN-897-1
- XF - mysql-myisam-symlink-security-bypass(45649)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql
- ...
- cpe:/a:mysql:mysql
- cpe:/a:mysql:mysql:3.20
- cpe:/a:mysql:mysql:3.20.32a
- cpe:/a:mysql:mysql:3.21
- cpe:/a:mysql:mysql:3.22
- cpe:/a:mysql:mysql:3.22.26
- cpe:/a:mysql:mysql:3.22.27
- cpe:/a:mysql:mysql:3.22.28
- cpe:/a:mysql:mysql:3.22.29
- cpe:/a:mysql:mysql:3.22.30
- cpe:/a:mysql:mysql:3.22.32
- cpe:/a:mysql:mysql:3.23
- cpe:/a:mysql:mysql:3.23.0:alpha
- cpe:/a:mysql:mysql:3.23.1
- cpe:/a:mysql:mysql:3.23.2
- cpe:/a:mysql:mysql:3.23.3
- cpe:/a:mysql:mysql:3.23.4
- cpe:/a:mysql:mysql:3.23.5
- cpe:/a:mysql:mysql:3.23.6
- cpe:/a:mysql:mysql:3.23.7
- cpe:/a:mysql:mysql:3.23.8
- cpe:/a:mysql:mysql:3.23.9
- cpe:/a:mysql:mysql:3.23.10
- cpe:/a:mysql:mysql:3.23.11
- cpe:/a:mysql:mysql:3.23.12
- cpe:/a:mysql:mysql:3.23.13
- cpe:/a:mysql:mysql:3.23.14
- cpe:/a:mysql:mysql:3.23.15
- cpe:/a:mysql:mysql:3.23.16
- cpe:/a:mysql:mysql:3.23.17
- cpe:/a:mysql:mysql:3.23.18
- cpe:/a:mysql:mysql:3.23.19
- cpe:/a:mysql:mysql:3.23.20:beta
- cpe:/a:mysql:mysql:3.23.21
- cpe:/a:mysql:mysql:3.23.22
- cpe:/a:mysql:mysql:3.23.23
- cpe:/a:mysql:mysql:3.23.24
- cpe:/a:mysql:mysql:3.23.25
- cpe:/a:mysql:mysql:3.23.26
- cpe:/a:mysql:mysql:3.23.27
- cpe:/a:mysql:mysql:3.23.28
- cpe:/a:mysql:mysql:3.23.28:gamma
- cpe:/a:mysql:mysql:3.23.29
- cpe:/a:mysql:mysql:3.23.30
- cpe:/a:mysql:mysql:3.23.31
- cpe:/a:mysql:mysql:3.23.32
- cpe:/a:mysql:mysql:3.23.33
- cpe:/a:mysql:mysql:3.23.34
- cpe:/a:mysql:mysql:3.23.35
- cpe:/a:mysql:mysql:3.23.36
- cpe:/a:mysql:mysql:3.23.37
- cpe:/a:mysql:mysql:3.23.38
- cpe:/a:mysql:mysql:3.23.39
- cpe:/a:mysql:mysql:3.23.40
- cpe:/a:mysql:mysql:3.23.41
- cpe:/a:mysql:mysql:3.23.42
- cpe:/a:mysql:mysql:3.23.43
- cpe:/a:mysql:mysql:3.23.44
- cpe:/a:mysql:mysql:3.23.45
- cpe:/a:mysql:mysql:3.23.46
- cpe:/a:mysql:mysql:3.23.47
- cpe:/a:mysql:mysql:3.23.48
- cpe:/a:mysql:mysql:3.23.49
- cpe:/a:mysql:mysql:3.23.50
- cpe:/a:mysql:mysql:3.23.51
- cpe:/a:mysql:mysql:3.23.52
- cpe:/a:mysql:mysql:3.23.53
- cpe:/a:mysql:mysql:3.23.53a
- cpe:/a:mysql:mysql:3.23.54
- cpe:/a:mysql:mysql:3.23.54a
- cpe:/a:mysql:mysql:3.23.55
- cpe:/a:mysql:mysql:3.23.56
- cpe:/a:mysql:mysql:3.23.57
- cpe:/a:mysql:mysql:3.23.58
- cpe:/a:mysql:mysql:3.23.59
- cpe:/a:mysql:mysql:4.0.0
- cpe:/a:mysql:mysql:4.0.1
- cpe:/a:mysql:mysql:4.0.2
- cpe:/a:mysql:mysql:4.0.3
- cpe:/a:mysql:mysql:4.0.4
- cpe:/a:mysql:mysql:4.0.5
- cpe:/a:mysql:mysql:4.0.5a
- cpe:/a:mysql:mysql:4.0.6
- cpe:/a:mysql:mysql:4.0.7
- cpe:/a:mysql:mysql:4.0.7:gamma
- cpe:/a:mysql:mysql:4.0.8
- cpe:/a:mysql:mysql:4.0.8:gamma
- cpe:/a:mysql:mysql:4.0.9
- cpe:/a:mysql:mysql:4.0.9:gamma
- cpe:/a:mysql:mysql:4.0.10
- cpe:/a:mysql:mysql:4.0.11
- cpe:/a:mysql:mysql:4.0.11:gamma
- cpe:/a:mysql:mysql:4.0.12
- cpe:/a:mysql:mysql:4.0.13
- cpe:/a:mysql:mysql:4.0.14
- cpe:/a:mysql:mysql:4.0.15
- cpe:/a:mysql:mysql:4.0.16
- cpe:/a:mysql:mysql:4.0.17
- cpe:/a:mysql:mysql:4.0.18
- cpe:/a:mysql:mysql:4.0.19
- cpe:/a:mysql:mysql:4.0.20
- cpe:/a:mysql:mysql:4.0.21
- cpe:/a:mysql:mysql:4.0.23
- cpe:/a:mysql:mysql:4.0.24
- cpe:/a:mysql:mysql:4.0.25
- cpe:/a:mysql:mysql:4.0.26
- cpe:/a:mysql:mysql:4.0.27
- cpe:/a:mysql:mysql:4.1
- cpe:/a:mysql:mysql:4.1.0
- cpe:/a:mysql:mysql:4.1.0:alpha
- cpe:/a:mysql:mysql:4.1.0.0
- cpe:/a:mysql:mysql:4.1.1
- cpe:/a:mysql:mysql:4.1.2
- cpe:/a:mysql:mysql:4.1.2:alpha
- cpe:/a:mysql:mysql:4.1.3
- cpe:/a:mysql:mysql:4.1.3:beta
- cpe:/a:mysql:mysql:4.1.4
- cpe:/a:mysql:mysql:4.1.5
- cpe:/a:mysql:mysql:4.1.6
- cpe:/a:mysql:mysql:4.1.7
- cpe:/a:mysql:mysql:4.1.8
- cpe:/a:mysql:mysql:4.1.9
- cpe:/a:mysql:mysql:4.1.10
- cpe:/a:mysql:mysql:4.1.10a
- cpe:/a:mysql:mysql:4.1.11
- cpe:/a:mysql:mysql:4.1.12
- cpe:/a:mysql:mysql:4.1.12a
- cpe:/a:mysql:mysql:4.1.13
- cpe:/a:mysql:mysql:4.1.13a
- cpe:/a:mysql:mysql:4.1.14
- cpe:/a:mysql:mysql:4.1.14a
- cpe:/a:mysql:mysql:4.1.15
- cpe:/a:mysql:mysql:4.1.15a
- cpe:/a:mysql:mysql:4.1.16
- cpe:/a:mysql:mysql:4.1.17
- cpe:/a:mysql:mysql:4.1.18
- cpe:/a:mysql:mysql:4.1.19
- cpe:/a:mysql:mysql:4.1.20
- cpe:/a:mysql:mysql:4.1.21
- cpe:/a:mysql:mysql:4.1.22
- cpe:/a:mysql:mysql:4.1.23
- cpe:/a:mysql:mysql:4.1.8a
- cpe:/a:mysql:mysql:5.0
- cpe:/a:mysql:mysql:5.0.0
- cpe:/a:mysql:mysql:5.0.0:alpha
- cpe:/a:mysql:mysql:5.0.0.0
- cpe:/a:mysql:mysql:5.0.1
- cpe:/a:mysql:mysql:5.0.10
- cpe:/a:mysql:mysql:5.0.10a
- cpe:/a:mysql:mysql:5.0.11
- cpe:/a:mysql:mysql:5.0.12
- cpe:/a:mysql:mysql:5.0.13
- cpe:/a:mysql:mysql:5.0.14
- cpe:/a:mysql:mysql:5.0.15
- cpe:/a:mysql:mysql:5.0.15a
- cpe:/a:mysql:mysql:5.0.16
- cpe:/a:mysql:mysql:5.0.16a
- cpe:/a:mysql:mysql:5.0.17
- cpe:/a:mysql:mysql:5.0.17a
- cpe:/a:mysql:mysql:5.0.1a
- cpe:/a:mysql:mysql:5.0.2
- cpe:/a:mysql:mysql:5.0.18
- cpe:/a:mysql:mysql:5.0.19
- cpe:/a:mysql:mysql:5.0.20
- cpe:/a:mysql:mysql:5.0.20a
- cpe:/a:mysql:mysql:5.0.21
- cpe:/a:mysql:mysql:5.0.22
- cpe:/a:mysql:mysql:5.0.22.1.0.1
- cpe:/a:mysql:mysql:5.0.23
- cpe:/a:mysql:mysql:5.0.24
- cpe:/a:mysql:mysql:5.0.24a
- cpe:/a:mysql:mysql:5.0.3
- cpe:/a:mysql:mysql:5.0.3:beta
- cpe:/a:mysql:mysql:5.0.3a
- cpe:/a:mysql:mysql:5.0.4
- cpe:/a:mysql:mysql:5.0.4a
- cpe:/a:mysql:mysql:5.0.5
- cpe:/a:mysql:mysql:5.0.5.0.21
- cpe:/a:mysql:mysql:5.0.25
- cpe:/a:mysql:mysql:5.0.27
- cpe:/a:mysql:mysql:5.0.30
- cpe:/a:mysql:mysql:5.0.30:sp1
- cpe:/a:mysql:mysql:5.0.32
- cpe:/a:mysql:mysql:5.0.33
- cpe:/a:mysql:mysql:5.0.36
- cpe:/a:mysql:mysql:5.0.37
- cpe:/a:mysql:mysql:5.0.38
- cpe:/a:mysql:mysql:5.0.41
- cpe:/a:mysql:mysql:5.0.42
- cpe:/a:mysql:mysql:5.0.44
- cpe:/a:mysql:mysql:5.0.45
- cpe:/a:mysql:mysql:5.0.50
- cpe:/a:mysql:mysql:5.0.51a
- cpe:/a:mysql:mysql:5.0.51b and all previous versions
- cpe:/a:mysql:mysql:5.0.6
- cpe:/a:mysql:mysql:5.0.7
- cpe:/a:mysql:mysql:5.0.8
- cpe:/a:mysql:mysql:5.0.9

CVE-2008-0226

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.

- APPLE - APPLE-SA-2008-10-09
- BID - 27140
- BID - 31681
- BUGTRAQ - 20080104 Multiple vulnerabilities in yaSSL 1.7.5
- BUGTRAQ - 20080104 Pre-auth buffer-overflow in mySQL through yaSSL
- CONFIRM - http://bugs.mysql.com/33814
- CONFIRM - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html
- CONFIRM - http://support.apple.com/kb/HT3216
- DEBIAN - DSA-1478
- MANDRIVA - MDVSA-2008:150
- SECUNIA - 28324
- SECUNIA - 28419
- SECUNIA - 28597
- SECUNIA - 29443
- SECUNIA - 32222
- SREASON - 3531
- UBUNTU - USN-588-1
- VUPEN - ADV-2008-0560
- VUPEN - ADV-2008-2780
- XF - yassl-inputbufferoperator-bo(39431)
- XF - yassl-processoldclienthello-bo(39429)

Vulnerable Software & Versions: (show all)

- cpe:/a:mysql:mysql
- ...
- cpe:/a:mysql:mysql
- cpe:/a:yassl:yassl:1.7.5 and all previous versions

### neethi-2.0.4.jar

Description: Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\neethi-2.0.4.jar
MD5: 3f0948a3b1316dfc94f9abce02da8901
SHA1: c5bbf05c56ef0d68eec17a7eb1ed9241052fd763

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | neethi
central | groupid | org.apache.neethi
central | version | 2.0.4
file | name | neethi
file | version | 2.0.4
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Neethi
Manifest | bundle-symbolicname | org.apache.neethi
Manifest | Bundle-Version | 2.0.4
pom | artifactid | neethi
pom | description | Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.
pom | groupid | apache.neethi
pom | name | Neethi
pom | organization name | http://www.apache.org/
pom | url | http://ws.apache.org/commons/neethi/
pom | version | 2.0.4

#### Identifiers

- cpe: cpe:/a:apache:apache_test:2.0.4 Confidence:LOW
- maven: org.apache.neethi:neethi:2.0.4 Confidence:HIGHEST

### debug/package.json

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\nodejs\node_modules\dns-sync\node_modules\debug\package.json
MD5: 8bde2d664cbfbe632bb74602151feefa
SHA1: 66db3474c54858d0d9005c4de8c3ec6f0cbe8a3b

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | package
package.json | author.email | tj@vision-media.ca
package.json | author.name | TJ Holowaychuk
package.json | description | small debugging utility
package.json | name | debug
package.json | name_project | debug_project
package.json | version | 0.7.4

#### Identifiers

- None

### shelljs/package.json

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\nodejs\node_modules\dns-sync\node_modules\shelljs\package.json
MD5: 3fa247269c2cc51f43108eca3bc041df
SHA1: 0826e1bf6c1950eb6e5193b58b35c4f5f2820b59

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | package
package.json | author.email | aadib@mozilla.com
package.json | author.name | Artur Adib
package.json | description | Portable Unix shell commands for Node.js
package.json | name | shelljs
package.json | name_project | shelljs_project
package.json | version | 0.2.6

#### Identifiers

- None

### dns-sync/package.json

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\nodejs\node_modules\dns-sync\package.json
MD5: 315fc29c23ad89bad4173f1891fd62ba
SHA1: 30f69d1288fd405cdba7e3d17947433a7999a4b1

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | package
package.json | author.name | Sanjeev Koranga
package.json | description | dns-sync
package.json | name | dns-sync
package.json | name_project | dns-sync_project
package.json | version | 0.1.0

#### Identifiers

- cpe: cpe:/a:dns-sync_project:dns-sync:0.1.0::~~~node.js~~ Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2014-9682

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

- CONFIRM - https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d
- CONFIRM - https://github.com/skoranga/node-dns-sync/issues/1
- MLIST - [oss-security] 20141111 CVE Request - dns-sync node module

Vulnerable Software & Versions:

- cpe:/a:dns-sync_project:dns-sync:0.1.0::~~~node.js~~ and all previous versions

### ognl-2.6.11.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ognl-2.6.11.jar
MD5: 1173ec5f8b1f6fb1473f4546d4b83bba
SHA1: 0c3f31f4a65461c44e6697bf29070e638bef09d8

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | ognl
central | groupid | opensymphony
central | version | 2.6.11
file | name | ognl
file | version | 2.6.11
jar | package name | ognl
pom | artifactid | ognl
pom | groupid | opensymphony
pom | name | OGNL - Object Graph Navigation Library
pom | organization name | http://www.opensymphony.com
pom | url | http://ognl.org
pom | version | 2.6.11

#### Identifiers

- maven: opensymphony:ognl:2.6.11 Confidence:HIGHEST

### openjpa-2.0.1.jar

Description: Apache OpenJPA implementation of JSR-317 JPA 2.0

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\openjpa-2.0.1.jar
MD5: d7bb08188165023ec883e32f4d636888
SHA1: 09b61112d8d8a100b06174074631c8a43e3e0a91

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | openjpa
central | groupid | org.apache.openjpa
central | version | 2.0.1
file | name | openjpa
file | version | 2.0.1
jar | package name | apache
jar | package name | openjpa
manifest | Bundle-Description | Apache OpenJPA implementation of JSR-317 JPA 2.0
Manifest | bundle-docurl | http://openjpa.apache.org/openjpa
Manifest | Bundle-Name | OpenJPA Aggregate Jar
Manifest | bundle-symbolicname | org.apache.openjpa
Manifest | Bundle-Version | 2.0.1
Manifest | Implementation-Title | OpenJPA Aggregate Jar
Manifest | Implementation-Version | 2.0.1
Manifest | specification-title | JSR-317 Java Persistence
Manifest | specification-vendor | Sun Microsystems, Inc.
pom | artifactid | openjpa
pom | groupid | apache.openjpa
pom | name | OpenJPA Aggregate Jar
pom | parent-artifactid | openjpa-parent
pom | parent-groupid | org.apache.openjpa
pom | version | 2.0.1

#### Identifiers

- cpe: cpe:/a:apache:openjpa:2.0.1 Confidence:HIGHEST
- maven: org.apache.openjpa:openjpa:2.0.1 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2013-1768

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

- AIXAPAR - PM86780
- AIXAPAR - PM86786
- AIXAPAR - PM86788
- AIXAPAR - PM86791
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462076
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462225
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462268
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462318
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462328
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462488
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462512
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1462558
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- FULLDISC - 20130612 [CVE-2013-1768] Apache OpenJPA security vulnerability
- MISC - http://www-01.ibm.com/support/docview.wss?uid=swg21635999
- REDHAT - RHSA-2013:1862
- XF - openjpa-cve20131768-command-execution(82268)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:openjpa:2.0.1
- ...
- cpe:/a:apache:openjpa:1.0.0
- cpe:/a:apache:openjpa:1.0.1
- cpe:/a:apache:openjpa:1.0.2
- cpe:/a:apache:openjpa:1.0.3
- cpe:/a:apache:openjpa:1.0.4
- cpe:/a:apache:openjpa:1.1.0
- cpe:/a:apache:openjpa:1.2.0
- cpe:/a:apache:openjpa:1.2.1
- cpe:/a:apache:openjpa:1.2.2
- cpe:/a:apache:openjpa:2.0.0
- cpe:/a:apache:openjpa:2.0.1
- cpe:/a:apache:openjpa:2.1.0
- cpe:/a:apache:openjpa:2.1.1
- cpe:/a:apache:openjpa:2.2.0
- cpe:/a:apache:openjpa:2.2.1

### openssl\opensslv.h

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\openssl\opensslv.h
MD5: 3d2889670d528538224b1618ef68f6c2
SHA1: 5eb05c0b783ccbcdc53d0109eab74b3c6e4a4e2c

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | opensslv
opensslv.h | Product | OpenSSL
opensslv.h | Vendor | OpenSSL
opensslv.h | Version Constant | 1.0.2c

#### Identifiers

- cpe: cpe:/a:openssl:openssl:1.0.2c Confidence:HIGH

#### Published Vulnerabilities

CVE-2016-6306

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-125 Out-of-bounds Read

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9
- CONFIRM - https://www.openssl.org/news/secadv/20160922.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.1s
- cpe:/a:openssl:openssl:1.0.1t
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2h

CVE-2016-6304

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=2c0d295e26306e15a92eb23a84a1802005c1c137
- CONFIRM - https://www.openssl.org/news/secadv/20160922.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.1s
- cpe:/a:openssl:openssl:1.0.1t
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2h
- cpe:/a:openssl:openssl:1.1.0

CVE-2016-6303

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-787 Out-of-bounds Write

Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1370146
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=55d83bf7c10c7b205fffa23fa7c3977491e56c07

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-6302

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.

- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=e97763c92c655dcf4af2860b3abd2bc4c8a267f9

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2842

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.

- CONFIRM - http://openssl.org/news/secadv/20160301.txt
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=578b956fe741bf8e84055547b1e83c28dd902c73
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- HP - HPSBGN03569
- HP - HPSBMU03575
- REDHAT - RHSA-2016:0722
- REDHAT - RHSA-2016:0996

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f

CVE-2016-2182

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-787 Out-of-bounds Write

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=07bed46f332fce8c1d157689a2cdf915a982ae34

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2181

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-189 Numeric Errors

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=1fb9fdc3027b27d8eb6a1e6a846435b070980770

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2180

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-125 Out-of-bounds Read

The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.

- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1359615
- CONFIRM - https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2179

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2178

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1343400
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2
- MISC - http://eprint.iacr.org/2016/594.pdf
- MLIST - [oss-security] 20160608 CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations
- MLIST - [oss-security] 20160609 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2177

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1341705
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=a004e72b95835136d3f1ea90517f706c24c03da7
- CONFIRM - https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl:1.0.2h and all previous versions

CVE-2016-2176

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

- APPLE - APPLE-SA-2016-07-18-1
- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=2919516136a4227d9e6d8f2fe66ef976aaf8c561
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- CONFIRM - https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- CONFIRM - https://support.apple.com/HT206903
- CONFIRM - https://www.openssl.org/news/secadv/20160503.txt

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1s and all previous versions
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2g

CVE-2016-2109

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

- APPLE - APPLE-SA-2016-07-18-1
- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=c62981390d6cf9e3d612c489b8b77c2913b25807
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- CONFIRM - https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- CONFIRM - https://support.apple.com/HT206903
- CONFIRM - https://www.openssl.org/news/secadv/20160503.txt
- REDHAT - RHSA-2016:0722
- REDHAT - RHSA-2016:0996

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1s and all previous versions
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2g

CVE-2016-2107

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session, NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

- APPLE - APPLE-SA-2016-07-18-1
- BID - 91787
- CONFIRM - http://source.android.com/security/bulletin/2016-07-01.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=68595c0c2886e7942a14f98c17a55a88afb6c292
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- CONFIRM - https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- CONFIRM - https://support.apple.com/HT206903
- CONFIRM - https://www.openssl.org/news/secadv/20160503.txt
- MISC - https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/
- REDHAT - RHSA-2016:0722
- REDHAT - RHSA-2016:0996
- SUSE - openSUSE-SU-2016:1566

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:hp:helion_openstack:2.0
- cpe:/a:hp:helion_openstack:2.1
- cpe:/a:hp:helion_openstack:2.1.2
- cpe:/a:hp:helion_openstack:2.1.4
- cpe:/a:openssl:openssl:1.0.1s and all previous versions
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2g

CVE-2016-2106

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-189 Numeric Errors

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

- APPLE - APPLE-SA-2016-07-18-1
- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=3f3582139fbb259a1c3cbb0a25236500a409bf26
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- CONFIRM - https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- CONFIRM - https://support.apple.com/HT206903
- CONFIRM - https://www.openssl.org/news/secadv/20160503.txt
- REDHAT - RHSA-2016:0722
- REDHAT - RHSA-2016:0996
- REDHAT - RHSA-2016:1648
- REDHAT - RHSA-2016:1649
- REDHAT - RHSA-2016:1650

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1s and all previous versions
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2g

CVE-2016-2105

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-189 Numeric Errors

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

- APPLE - APPLE-SA-2016-07-18-1
- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=5b814481f3573fa9677f3a31ee51322e2a22ee6a
- CONFIRM - https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- CONFIRM - https://support.apple.com/HT206903
- CONFIRM - https://www.openssl.org/news/secadv/20160503.txt
- REDHAT - RHSA-2016:0722
- REDHAT - RHSA-2016:0996
- REDHAT - RHSA-2016:1648
- REDHAT - RHSA-2016:1649
- REDHAT - RHSA-2016:1650
- SUSE - openSUSE-SU-2016:1566

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1s and all previous versions
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:openssl:openssl:1.0.2g
- cpe:/a:oracle:mysql:5.6.30 and all previous versions
- cpe:/a:oracle:mysql:5.7.12 and all previous versions

CVE-2016-0800

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://access.redhat.com/security/vulnerabilities/drown
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073516
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05096953
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05143554
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176765
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
- HP - HPSBGN03569
- HP - HPSBMU03573
- HP - HPSBMU03575
- MISC - https://drownattack.com
- REDHAT - RHSA-2016:1519

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:pulsesecure:client:-::~~~iphone_os~~
- cpe:/a:pulsesecure:steel_belted_radius:-

CVE-2016-0799

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.

- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20160301.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=578b956fe741bf8e84055547b1e83c28dd902c73
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
- HP - HPSBGN03569
- HP - HPSBMU03575
- REDHAT - RHSA-2016:0722
- REDHAT - RHSA-2016:0996

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:pulsesecure:client:-::~~~android~~
- cpe:/a:pulsesecure:client:-::~~~iphone_os~~
- cpe:/a:pulsesecure:steel_belted_radius:-

CVE-2016-0798

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors

Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.

- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20160301.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=259b664f950c2ba66fbf4b0fe5281327904ead21
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f

CVE-2016-0797

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20160301.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=c175308407858afff3fc8c2e5e085d94d12edc7d
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
- CONFIRM - https://kc.mcafee.com/corporate/index?page=content&id=SB10156
- HP - HPSBGN03563
- SUSE - openSUSE-SU-2016:1566

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f

CVE-2016-0705

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20160301.txt
- CONFIRM - http://source.android.com/security/bulletin/2016-05-01.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=6c88c71b4e4825c7bc0489306d062d017634eb88
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176716
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
- HP - HPSBGN03563
- HP - HPSBGN03569
- HP - HPSBMU03575
- SUSE - openSUSE-SU-2016:1566

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f
- cpe:/a:oracle:mysql:5.6.29 and all previous versions
- cpe:/a:oracle:mysql:5.7.11 and all previous versions

CVE-2016-0702

Severity: Low
CVSS Score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.

- CONFIRM - http://openssl.org/news/secadv/20160301.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=708dc2f1291e104fe4eef810bb8ffc1fae5b19c1
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
- HP - HPSBGN03563
- MISC - http://cachebleed.info
- SUSE - openSUSE-SU-2016:1566

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.1r
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:openssl:openssl:1.0.2f

CVE-2016-0701

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

- BID - 91787
- CONFIRM - http://www.openssl.org/news/secadv/20160128.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=878e2c5b13010329c203f309ed0c8f2113f85648
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=c5b831f21d0d29d1e517d139d9d101763f60c9a2
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821
- MISC - http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e

CVE-2015-3197

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

- BID - 91787
- CONFIRM - http://www.openssl.org/news/secadv/20160128.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=d81a1600588b726c2bdccda7efad3cc7a87d6245

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1:beta1
- cpe:/a:openssl:openssl:1.0.1:beta2
- cpe:/a:openssl:openssl:1.0.1:beta3
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.1q
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2:beta1
- cpe:/a:openssl:openssl:1.0.2:beta2
- cpe:/a:openssl:openssl:1.0.2:beta3
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:openssl:openssl:1.0.2e
- cpe:/a:oracle:exalogic_infrastructure:1.0
- cpe:/a:oracle:exalogic_infrastructure:2.0
- cpe:/a:oracle:oss_support_tools:8.11.16.3.8
- cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53
- cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54
- cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55
- cpe:/a:oracle:tuxedo:12.1.1.0
- cpe:/a:oracle:vm_virtualbox:5.0.16

CVE-2015-3195

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-200 Information Exposure

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

- APPLE - APPLE-SA-2016-03-21-5
- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20151203.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=cc598f321fbac9c04da5766243ed55d55948637d
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100
- CONFIRM - https://support.apple.com/HT206167
- HP - HPSBGN03536

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:apple:mac_os_x:10.11.3 and all previous versions
- cpe:/a:openssl:openssl:0.9.8zg
- cpe:/a:openssl:openssl:1.0.0
- cpe:/a:openssl:openssl:1.0.0a
- cpe:/a:openssl:openssl:1.0.0b
- cpe:/a:openssl:openssl:1.0.0c
- cpe:/a:openssl:openssl:1.0.0d
- cpe:/a:openssl:openssl:1.0.0e
- cpe:/a:openssl:openssl:1.0.0f
- cpe:/a:openssl:openssl:1.0.0g
- cpe:/a:openssl:openssl:1.0.0h
- cpe:/a:openssl:openssl:1.0.0i
- cpe:/a:openssl:openssl:1.0.0j
- cpe:/a:openssl:openssl:1.0.0k
- cpe:/a:openssl:openssl:1.0.0l
- cpe:/a:openssl:openssl:1.0.0m
- cpe:/a:openssl:openssl:1.0.0n
- cpe:/a:openssl:openssl:1.0.0o
- cpe:/a:openssl:openssl:1.0.0p
- cpe:/a:openssl:openssl:1.0.0q
- cpe:/a:openssl:openssl:1.0.0r
- cpe:/a:openssl:openssl:1.0.0s
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:oracle:api_gateway:11.1.2.3.0
- cpe:/a:oracle:api_gateway:11.1.2.4.0
- cpe:/a:oracle:exalogic_infrastructure:1.0
- cpe:/a:oracle:exalogic_infrastructure:2.0
- cpe:/a:oracle:life_sciences_data_hub:2.1
- cpe:/a:oracle:sun_ray_software:11.1
- cpe:/a:oracle:transportation_management:6.1
- cpe:/a:oracle:transportation_management:6.2
- cpe:/a:oracle:vm_virtualbox:4.3.36 and all previous versions
- cpe:/a:oracle:vm_virtualbox:5.0.14 and all previous versions

CVE-2015-3194

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.

- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20151203.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1288320
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=c394a488942387246653833359a5c94b5832674e
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=d8541d7e9e63bf5f343af24644046c8d96498c17
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100
- HP - HPSBGN03536

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:openssl:openssl:1.0.1d
- cpe:/a:openssl:openssl:1.0.1e
- cpe:/a:openssl:openssl:1.0.1f
- cpe:/a:openssl:openssl:1.0.1g
- cpe:/a:openssl:openssl:1.0.1h
- cpe:/a:openssl:openssl:1.0.1i
- cpe:/a:openssl:openssl:1.0.1j
- cpe:/a:openssl:openssl:1.0.1k
- cpe:/a:openssl:openssl:1.0.1l
- cpe:/a:openssl:openssl:1.0.1m
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.1p
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d
- cpe:/a:oracle:mysql:5.6.28 and all previous versions
- cpe:/a:oracle:mysql:5.7.10 and all previous versions

CVE-2015-3193

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.

- BID - 91787
- CONFIRM - http://openssl.org/news/secadv/20151203.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1288317
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=d73cc256c8e256c32ed959456101b73ba9842f72
- CONFIRM - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100
- MISC - https://blog.fuzzing-project.org/31-Fuzzing-Math-miscalculations-in-OpenSSLs-BN_mod_exp-CVE-2015-3193.html

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d

CVE-2015-1794

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-189 Numeric Errors

The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.

- CONFIRM - http://openssl.org/news/secadv/20151203.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=ada57746b6b80beae73111fe1291bf8dd89af91c

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.2
- cpe:/a:openssl:openssl:1.0.2a
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:openssl:openssl:1.0.2d

CVE-2015-1793

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-254 Security Features

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

- BID - 91787
- CONFIRM - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
- CONFIRM - http://openssl.org/news/secadv_20150709.txt
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- CONFIRM - https://git.openssl.org/?p=openssl.git;a=commit;h=9a0db453ba017ebcaccbee933ee6511a9ae4d1c8
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351
- HP - HPSBGN03424
- HP - SSRT102180

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:1.0.2c
- ...
- cpe:/a:openssl:openssl:1.0.1n
- cpe:/a:openssl:openssl:1.0.1o
- cpe:/a:openssl:openssl:1.0.2b
- cpe:/a:openssl:openssl:1.0.2c
- cpe:/a:oracle:jd_edwards_enterpriseone_tools:9.1
- cpe:/a:oracle:jd_edwards_enterpriseone_tools:9.2
- cpe:/a:oracle:opus_10g_ethernet_switch_family:2.0.0.6 and all previous versions
- cpe:/a:oracle:supply_chain_products_suite:6.1.2.2
- cpe:/a:oracle:supply_chain_products_suite:6.1.3.0
- cpe:/a:oracle:supply_chain_products_suite:6.2.0

CVE-2013-0169

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-310 Cryptographic Issues

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

- APPLE - APPLE-SA-2013-09-12-1
- CERT - TA13-051A
- CERT-VN - VU#737740
- CONFIRM - http://support.apple.com/kb/HT5880
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- CONFIRM - http://www.matrixssl.org/news.html
- CONFIRM - http://www.openssl.org/news/secadv_20130204.txt
- CONFIRM - http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html
- CONFIRM - http://www.splunk.com/view/SP-CAAAHXG
- CONFIRM - https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released
- CONFIRM - https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084
- DEBIAN - DSA-2621
- DEBIAN - DSA-2622
- FEDORA - FEDORA-2013-4403
- HP - HPSBMU02874
- HP - HPSBUX02856
- HP - HPSBUX02857
- HP - HPSBUX02909
- HP - SSRT101103
- HP - SSRT101104
- HP - SSRT101184
- HP - SSRT101289
- MANDRIVA - MDVSA-2013:095
- MISC - http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/
- MISC - http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
- MLIST - [oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations
- REDHAT - RHSA-2013:0587
- REDHAT - RHSA-2013:0782
- REDHAT - RHSA-2013:0783
- REDHAT - RHSA-2013:0833
- REDHAT - RHSA-2013:1455
- REDHAT - RHSA-2013:1456
- SECTRACK - 1029190
- SECUNIA - 53623
- SECUNIA - 55108
- SECUNIA - 55139
- SECUNIA - 55322
- SECUNIA - 55350
- SECUNIA - 55351
- SUSE - SUSE-SU-2013:0328
- SUSE - SUSE-SU-2013:0701
- SUSE - SUSE-SU-2014:0320
- SUSE - openSUSE-SU-2013:0375
- SUSE - openSUSE-SU-2013:0378
- UBUNTU - USN-1735-1

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl
- ...
- cpe:/a:openssl:openssl
- cpe:/a:openssl:openssl:0.9.8
- cpe:/a:openssl:openssl:0.9.8a
- cpe:/a:openssl:openssl:0.9.8b
- cpe:/a:openssl:openssl:0.9.8c
- cpe:/a:openssl:openssl:0.9.8d
- cpe:/a:openssl:openssl:0.9.8f
- cpe:/a:openssl:openssl:0.9.8g
- cpe:/a:openssl:openssl:0.9.8h
- cpe:/a:openssl:openssl:0.9.8i
- cpe:/a:openssl:openssl:0.9.8j
- cpe:/a:openssl:openssl:0.9.8k
- cpe:/a:openssl:openssl:0.9.8l
- cpe:/a:openssl:openssl:0.9.8m
- cpe:/a:openssl:openssl:0.9.8n
- cpe:/a:openssl:openssl:0.9.8o
- cpe:/a:openssl:openssl:0.9.8p
- cpe:/a:openssl:openssl:0.9.8q
- cpe:/a:openssl:openssl:0.9.8r
- cpe:/a:openssl:openssl:0.9.8s
- cpe:/a:openssl:openssl:0.9.8t
- cpe:/a:openssl:openssl:0.9.8u
- cpe:/a:openssl:openssl:0.9.8v
- cpe:/a:openssl:openssl:0.9.8w
- cpe:/a:openssl:openssl:0.9.8x
- cpe:/a:openssl:openssl:1.0.0
- cpe:/a:openssl:openssl:1.0.0a
- cpe:/a:openssl:openssl:1.0.0b
- cpe:/a:openssl:openssl:1.0.0c
- cpe:/a:openssl:openssl:1.0.0d
- cpe:/a:openssl:openssl:1.0.0e
- cpe:/a:openssl:openssl:1.0.0f
- cpe:/a:openssl:openssl:1.0.0g
- cpe:/a:openssl:openssl:1.0.0i
- cpe:/a:openssl:openssl:1.0.0j
- cpe:/a:openssl:openssl:1.0.1
- cpe:/a:openssl:openssl:1.0.1a
- cpe:/a:openssl:openssl:1.0.1b
- cpe:/a:openssl:openssl:1.0.1c
- cpe:/a:oracle:openjdk:-
- cpe:/a:oracle:openjdk:1.6.0
- cpe:/a:oracle:openjdk:1.7.0
- cpe:/a:oracle:openjdk:1.8.0
- cpe:/a:polarssl:polarssl:0.10.0
- cpe:/a:polarssl:polarssl:0.10.1
- cpe:/a:polarssl:polarssl:0.11.0
- cpe:/a:polarssl:polarssl:0.11.1
- cpe:/a:polarssl:polarssl:0.12.0
- cpe:/a:polarssl:polarssl:0.12.1
- cpe:/a:polarssl:polarssl:0.13.1
- cpe:/a:polarssl:polarssl:0.14.0
- cpe:/a:polarssl:polarssl:0.14.2
- cpe:/a:polarssl:polarssl:0.14.3
- cpe:/a:polarssl:polarssl:0.99:pre1
- cpe:/a:polarssl:polarssl:0.99:pre3
- cpe:/a:polarssl:polarssl:0.99:pre4
- cpe:/a:polarssl:polarssl:0.99:pre5
- cpe:/a:polarssl:polarssl:1.0.0
- cpe:/a:polarssl:polarssl:1.1.0
- cpe:/a:polarssl:polarssl:1.1.0:rc0
- cpe:/a:polarssl:polarssl:1.1.0:rc1
- cpe:/a:polarssl:polarssl:1.1.1
- cpe:/a:polarssl:polarssl:1.1.2
- cpe:/a:polarssl:polarssl:1.1.3
- cpe:/a:polarssl:polarssl:1.1.4

CVE-2009-0590

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.

- APPLE - APPLE-SA-2009-09-10-2
- BID - 34256
- BUGTRAQ - 20090403 rPSA-2009-0057-1 m2crypto openssl openssl-scripts
- BUGTRAQ - 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console
- CONFIRM - http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847
- CONFIRM - http://support.apple.com/kb/HT3865
- CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2009-172.htm
- CONFIRM - http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html
- CONFIRM - http://wiki.rpath.com/Advisories:rPSA-2009-0057
- CONFIRM - http://www.openssl.org/news/secadv_20090325.txt
- CONFIRM - http://www.php.net/archive/2009.php#id2009-04-08-1
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2010-0019.html
- CONFIRM - https://kb.bluecoat.com/index?page=content&id=SA50
- DEBIAN - DSA-1763
- FREEBSD - FreeBSD-SA-09:08
- HP - HPSBMA02447
- HP - HPSBUX02435
- HP - SSRT090059
- HP - SSRT090062
- MANDRIVA - MDVSA-2009:087
- MISC - http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0057
- MLIST - [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates
- MLIST - [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released
- MLIST - [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released
- NETBSD - NetBSD-SA2009-008
- OSVDB - 52864
- REDHAT - RHSA-2009:1335
- SECTRACK - 1021905
- SECUNIA - 34411
- SECUNIA - 34460
- SECUNIA - 34509
- SECUNIA - 34561
- SECUNIA - 34666
- SECUNIA - 34896
- SECUNIA - 34960
- SECUNIA - 35065
- SECUNIA - 35181
- SECUNIA - 35380
- SECUNIA - 35729
- SECUNIA - 36533
- SECUNIA - 36701
- SECUNIA - 38794
- SECUNIA - 38834
- SECUNIA - 42467
- SECUNIA - 42724
- SECUNIA - 42733
- SUNALERT - 258048
- SUSE - SUSE-SR:2009:010
- SUSE - SUSE-SU-2011:0847
- SUSE - openSUSE-SU-2011:0845
- UBUNTU - USN-750-1
- VUPEN - ADV-2009-0850
- VUPEN - ADV-2009-1020
- VUPEN - ADV-2009-1175
- VUPEN - ADV-2009-1220
- VUPEN - ADV-2009-1548
- VUPEN - ADV-2010-0528
- VUPEN - ADV-2010-3126
- XF - openssl-asn1-stringprintex-dos(49431)

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl:::openvms
- ...
- cpe:/a:openssl:openssl:::openvms
- cpe:/a:openssl:openssl:0.9.1c
- cpe:/a:openssl:openssl:0.9.2b
- cpe:/a:openssl:openssl:0.9.3
- cpe:/a:openssl:openssl:0.9.3a
- cpe:/a:openssl:openssl:0.9.4
- cpe:/a:openssl:openssl:0.9.5
- cpe:/a:openssl:openssl:0.9.5:beta1
- cpe:/a:openssl:openssl:0.9.5:beta2
- cpe:/a:openssl:openssl:0.9.5a
- cpe:/a:openssl:openssl:0.9.5a:beta1
- cpe:/a:openssl:openssl:0.9.5a:beta2
- cpe:/a:openssl:openssl:0.9.6
- cpe:/a:openssl:openssl:0.9.6:beta1
- cpe:/a:openssl:openssl:0.9.6:beta2
- cpe:/a:openssl:openssl:0.9.6:beta3
- cpe:/a:openssl:openssl:0.9.6a
- cpe:/a:openssl:openssl:0.9.6a:beta1
- cpe:/a:openssl:openssl:0.9.6a:beta2
- cpe:/a:openssl:openssl:0.9.6a:beta3
- cpe:/a:openssl:openssl:0.9.6b
- cpe:/a:openssl:openssl:0.9.6c
- cpe:/a:openssl:openssl:0.9.6d
- cpe:/a:openssl:openssl:0.9.6e
- cpe:/a:openssl:openssl:0.9.6f
- cpe:/a:openssl:openssl:0.9.6g
- cpe:/a:openssl:openssl:0.9.6h
- cpe:/a:openssl:openssl:0.9.6i
- cpe:/a:openssl:openssl:0.9.6j
- cpe:/a:openssl:openssl:0.9.6k
- cpe:/a:openssl:openssl:0.9.6l
- cpe:/a:openssl:openssl:0.9.6m
- cpe:/a:openssl:openssl:0.9.7
- cpe:/a:openssl:openssl:0.9.7:beta1
- cpe:/a:openssl:openssl:0.9.7:beta2
- cpe:/a:openssl:openssl:0.9.7:beta3
- cpe:/a:openssl:openssl:0.9.7:beta4
- cpe:/a:openssl:openssl:0.9.7:beta5
- cpe:/a:openssl:openssl:0.9.7:beta6
- cpe:/a:openssl:openssl:0.9.7a
- cpe:/a:openssl:openssl:0.9.7b
- cpe:/a:openssl:openssl:0.9.7c
- cpe:/a:openssl:openssl:0.9.7d
- cpe:/a:openssl:openssl:0.9.7e
- cpe:/a:openssl:openssl:0.9.7f
- cpe:/a:openssl:openssl:0.9.7g
- cpe:/a:openssl:openssl:0.9.7h
- cpe:/a:openssl:openssl:0.9.7i
- cpe:/a:openssl:openssl:0.9.7j
- cpe:/a:openssl:openssl:0.9.7k
- cpe:/a:openssl:openssl:0.9.7l
- cpe:/a:openssl:openssl:0.9.8
- cpe:/a:openssl:openssl:0.9.8a
- cpe:/a:openssl:openssl:0.9.8b
- cpe:/a:openssl:openssl:0.9.8c
- cpe:/a:openssl:openssl:0.9.8d
- cpe:/a:openssl:openssl:0.9.8e
- cpe:/a:openssl:openssl:0.9.8f
- cpe:/a:openssl:openssl:0.9.8g
- cpe:/a:openssl:openssl:0.9.8h

CVE-2007-5536

Severity: Medium
CVSS Score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Unspecified vulnerability in OpenSSL before A.00.09.07l on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to cause a denial of service via unspecified vectors.

- BID - 26093
- HP - HPSBUX02277
- HP - SSRT071453
- OSVDB - 37894
- SECUNIA - 27265
- VUPEN - ADV-2007-3526
- XF - hpux-openssl-dos(37231)

Vulnerable Software & Versions:

- cpe:/a:openssl:openssl

CVE-1999-0428

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.

- OSVDB - 3936

Vulnerable Software & Versions: (show all)

- cpe:/a:openssl:openssl
- ...
- cpe:/a:openssl:openssl
- cpe:/a:ssleay:ssleay

### org.mortbay.jetty.jar

Description: Jetty is an open-source, standards-based, full-featured web server implemented entirely in Java. It is released under the Apache 2.0 licence and is therefore free for commercial use and distribution. First created in 1995, Jetty has benefitted from input from a vast user community and consistent and focused development by a stable core of lead developers. There are many more examples of Jetty in action on the Jetty Powered Page that has selections from among the tens of thousands of production Jetty instances. However, as Jetty aims to be as unobtrusive as possible, countless websites and products are based around Jetty, but Jetty is invisible!

License:

    Apache 2.0: http://jetty.mortbay.org/LICENSE.TXT

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\org.mortbay.jetty.jar
MD5: 8abfd9ef03680c5b9b418abd918ce525
SHA1: 7b11e767b884d5b872310ce390219b59ffd64a1e

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jetty
central | artifactid | org.mortbay.jetty
central | groupid | jetty
central | version | 4.2.27
file | name | org.mortbay.jetty
jar | package name | mortbay
Manifest | implementation-url | http://jetty.mortbay.org
Manifest | Implementation-Vendor | Mort Bay Consulting, Pty. Ltd.
Manifest | Implementation-Version | 4.2.27
Manifest | package-title | org.mortbay.http
manifest: org/mortbay/http/ | Implementation-Title | Mort Bay HTTP Server
manifest: org/mortbay/jetty/ | Implementation-Title | Jetty/4.2
manifest: org/mortbay/jetty/ | Specification-Title | Servlet/2.3
manifest: org/mortbay/util/ | Implementation-Title | Mort Bay Misc. Utilities
pom | artifactid | jetty
pom | description | Jetty is an open-source, standards-based, full-featured web server implemented entirely in Java. It is released under the Apache 2.0 licence and is therefore free for commercial use and distribution. First created in 1995, Jetty has benefitted from input from a vast user community and consistent and focused development by a stable core of lead developers. There are many more examples of Jetty in action on the Jetty Powered Page that has selections from among the tens of thousands of production Jetty instances. However, as Jetty aims to be as unobtrusive as possible, countless websites and products are based around Jetty, but Jetty is invisible!
pom | groupid | jetty
pom | url | http://jetty.mortbay.org/
pom | version | 4.2.27

#### Identifiers

- cpe: cpe:/a:jetty:jetty:4.2.27 Confidence:LOW
- cpe: cpe:/a:mortbay:jetty:4.2.27 Confidence:HIGHEST
- cpe: cpe:/a:mortbay_jetty:jetty:4.2.27 Confidence:LOW
- maven: jetty:jetty:4.2.27 Confidence:HIGHEST
- maven: jetty:org.mortbay.jetty:4.2.27 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2011-4461

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-310 Cryptographic Issues

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

- BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
- CERT-VN - VU#903934
- MISC - http://www.nruns.com/_downloads/advisory28122011.pdf
- MISC - http://www.ocert.org/advisories/ocert-2011-003.html
- SECTRACK - 1026475
- SECUNIA - 47408
- SECUNIA - 48981
- UBUNTU - USN-1429-1
- XF - jetty-hash-dos(72017)

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:4.2.27
- ...
- cpe:/a:morbtay:jetty:6.1.0
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.11
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1
- cpe:/a:mortbay:jetty:5.1:rc0
- cpe:/a:mortbay:jetty:5.1:rc1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0
- cpe:/a:mortbay:jetty:5.1.5:rc1
- cpe:/a:mortbay:jetty:5.1.5:rc2
- cpe:/a:mortbay:jetty:5.1.6
- cpe:/a:mortbay:jetty:5.1.7
- cpe:/a:mortbay:jetty:5.1.7:rc0
- cpe:/a:mortbay:jetty:5.1.8
- cpe:/a:mortbay:jetty:5.1.9
- cpe:/a:mortbay:jetty:5.1.10
- cpe:/a:mortbay:jetty:5.1.11
- cpe:/a:mortbay:jetty:5.1.11:rc0
- cpe:/a:mortbay:jetty:5.1.12
- cpe:/a:mortbay:jetty:5.1.13
- cpe:/a:mortbay:jetty:5.1.14
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16
- cpe:/a:mortbay:jetty:6.1.19
- cpe:/a:mortbay:jetty:6.1.20
- cpe:/a:mortbay:jetty:6.1.21
- cpe:/a:mortbay:jetty:7.0.0
- cpe:/a:mortbay:jetty:7.0.0:m1
- cpe:/a:mortbay:jetty:7.0.0:m2
- cpe:/a:mortbay:jetty:7.0.0:pre0
- cpe:/a:mortbay:jetty:7.0.0:pre1
- cpe:/a:mortbay:jetty:7.0.0:pre3
- cpe:/a:mortbay:jetty:8.1.0:rc2 and all previous versions

CVE-2009-1524

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.

- BID - 34800
- CONFIRM - http://jira.codehaus.org/browse/JETTY-980
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=499867
- HP - HPSBMA02553
- HP - SSRT100184
- SECUNIA - 34975
- SECUNIA - 40553
- VUPEN - ADV-2010-1792

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:4.2.27
- ...
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1:rc0
- cpe:/a:mortbay:jetty:5.1:rc1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0
- cpe:/a:mortbay:jetty:5.1.5:rc1
- cpe:/a:mortbay:jetty:5.1.5:rc2
- cpe:/a:mortbay:jetty:5.1.6
- cpe:/a:mortbay:jetty:5.1.7
- cpe:/a:mortbay:jetty:5.1.7:rc0
- cpe:/a:mortbay:jetty:5.1.8
- cpe:/a:mortbay:jetty:5.1.9
- cpe:/a:mortbay:jetty:5.1.10
- cpe:/a:mortbay:jetty:5.1.11
- cpe:/a:mortbay:jetty:5.1.11:rc0
- cpe:/a:mortbay:jetty:5.1.12
- cpe:/a:mortbay:jetty:5.1.13
- cpe:/a:mortbay:jetty:5.1.14
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16 and all previous versions

CVE-2009-1523

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

- BID - 34800
- BID - 35675
- CERT-VN - VU#402580
- CONFIRM - http://jira.codehaus.org/browse/JETTY-1004
- CONFIRM - http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=499867
- FEDORA - FEDORA-2009-5500
- FEDORA - FEDORA-2009-5509
- FEDORA - FEDORA-2009-5513
- HP - HPSBMA02553
- HP - SSRT100184
- SECTRACK - 1022563
- SECUNIA - 34975
- SECUNIA - 35143
- SECUNIA - 35225
- SECUNIA - 35776
- SECUNIA - 40553
- VUPEN - ADV-2009-1900
- VUPEN - ADV-2010-1792

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:4.2.27
- ...
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1:rc0
- cpe:/a:mortbay:jetty:5.1:rc1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0
- cpe:/a:mortbay:jetty:5.1.5:rc1
- cpe:/a:mortbay:jetty:5.1.5:rc2
- cpe:/a:mortbay:jetty:5.1.6
- cpe:/a:mortbay:jetty:5.1.7
- cpe:/a:mortbay:jetty:5.1.7:rc0
- cpe:/a:mortbay:jetty:5.1.8
- cpe:/a:mortbay:jetty:5.1.9
- cpe:/a:mortbay:jetty:5.1.10
- cpe:/a:mortbay:jetty:5.1.11
- cpe:/a:mortbay:jetty:5.1.11:rc0
- cpe:/a:mortbay:jetty:5.1.12
- cpe:/a:mortbay:jetty:5.1.13
- cpe:/a:mortbay:jetty:5.1.14
- cpe:/a:mortbay:jetty:6.0.0
- cpe:/a:mortbay:jetty:6.0.0:alpha0
- cpe:/a:mortbay:jetty:6.0.0:alpha1
- cpe:/a:mortbay:jetty:6.0.0:alpha2
- cpe:/a:mortbay:jetty:6.0.0:alpha3
- cpe:/a:mortbay:jetty:6.0.0:beta0
- cpe:/a:mortbay:jetty:6.0.0:beta1
- cpe:/a:mortbay:jetty:6.0.0:beta10
- cpe:/a:mortbay:jetty:6.0.0:beta11
- cpe:/a:mortbay:jetty:6.0.0:beta12
- cpe:/a:mortbay:jetty:6.0.0:beta14
- cpe:/a:mortbay:jetty:6.0.0:beta15
- cpe:/a:mortbay:jetty:6.0.0:beta16
- cpe:/a:mortbay:jetty:6.0.0:beta17
- cpe:/a:mortbay:jetty:6.0.0:beta2
- cpe:/a:mortbay:jetty:6.0.0:beta3
- cpe:/a:mortbay:jetty:6.0.0:beta4
- cpe:/a:mortbay:jetty:6.0.0:beta5
- cpe:/a:mortbay:jetty:6.0.0:beta6
- cpe:/a:mortbay:jetty:6.0.0:beta7
- cpe:/a:mortbay:jetty:6.0.0:beta8
- cpe:/a:mortbay:jetty:6.0.0:beta9
- cpe:/a:mortbay:jetty:6.0.0:betax
- cpe:/a:mortbay:jetty:6.0.0:rc0
- cpe:/a:mortbay:jetty:6.0.0:rc1
- cpe:/a:mortbay:jetty:6.0.0:rc2
- cpe:/a:mortbay:jetty:6.0.0:rc3
- cpe:/a:mortbay:jetty:6.0.0:rc4
- cpe:/a:mortbay:jetty:6.0.1
- cpe:/a:mortbay:jetty:6.0.2
- cpe:/a:mortbay:jetty:6.1.0
- cpe:/a:mortbay:jetty:6.1.0:pre0
- cpe:/a:mortbay:jetty:6.1.0:pre1
- cpe:/a:mortbay:jetty:6.1.0:pre2
- cpe:/a:mortbay:jetty:6.1.0:pre3
- cpe:/a:mortbay:jetty:6.1.0:rc0
- cpe:/a:mortbay:jetty:6.1.0:rc1
- cpe:/a:mortbay:jetty:6.1.0:rc2
- cpe:/a:mortbay:jetty:6.1.0:rc3
- cpe:/a:mortbay:jetty:6.1.1
- cpe:/a:mortbay:jetty:6.1.1:rc0
- cpe:/a:mortbay:jetty:6.1.2
- cpe:/a:mortbay:jetty:6.1.2:pre0
- cpe:/a:mortbay:jetty:6.1.2:pre1
- cpe:/a:mortbay:jetty:6.1.2:rc0
- cpe:/a:mortbay:jetty:6.1.2:rc1
- cpe:/a:mortbay:jetty:6.1.2:rc2
- cpe:/a:mortbay:jetty:6.1.2:rc3
- cpe:/a:mortbay:jetty:6.1.2:rc4
- cpe:/a:mortbay:jetty:6.1.2:rc5
- cpe:/a:mortbay:jetty:6.1.3
- cpe:/a:mortbay:jetty:6.1.4
- cpe:/a:mortbay:jetty:6.1.4:rc0
- cpe:/a:mortbay:jetty:6.1.4:rc1
- cpe:/a:mortbay:jetty:6.1.5
- cpe:/a:mortbay:jetty:6.1.5:rc0
- cpe:/a:mortbay:jetty:6.1.6
- cpe:/a:mortbay:jetty:6.1.6:rc0
- cpe:/a:mortbay:jetty:6.1.6:rc1
- cpe:/a:mortbay:jetty:6.1.7
- cpe:/a:mortbay:jetty:6.1.8
- cpe:/a:mortbay:jetty:6.1.9
- cpe:/a:mortbay:jetty:6.1.10
- cpe:/a:mortbay:jetty:6.1.11
- cpe:/a:mortbay:jetty:6.1.12
- cpe:/a:mortbay:jetty:6.1.12:rc1
- cpe:/a:mortbay:jetty:6.1.12:rc2
- cpe:/a:mortbay:jetty:6.1.12:rc3
- cpe:/a:mortbay:jetty:6.1.12:rc4
- cpe:/a:mortbay:jetty:6.1.12:rc5
- cpe:/a:mortbay:jetty:6.1.14
- cpe:/a:mortbay:jetty:6.1.15
- cpe:/a:mortbay:jetty:6.1.15:pre0
- cpe:/a:mortbay:jetty:6.1.15:rc2
- cpe:/a:mortbay:jetty:6.1.15:rc3
- cpe:/a:mortbay:jetty:6.1.15:rc4
- cpe:/a:mortbay:jetty:6.1.15:rc5
- cpe:/a:mortbay:jetty:6.1.16 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0
- cpe:/a:mortbay:jetty:7.0.0:m1 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:m2 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:pre0 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:pre1 and all previous versions
- cpe:/a:mortbay:jetty:7.0.0:pre3 and all previous versions

CVE-2007-5615

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

- BID - 26696
- CERT-VN - VU#212984
- CONFIRM - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
- FEDORA - FEDORA-2008-6141
- FEDORA - FEDORA-2008-6164
- OSVDB - 42495
- SECUNIA - 27925
- SECUNIA - 30941
- SECUNIA - 35143
- SUSE - SUSE-SR:2009:004

Vulnerable Software & Versions:

- cpe:/a:mortbay_jetty:jetty:6.1.6rc0 and all previous versions

CVE-2005-3747

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758.

- BID - 15515
- CONFIRM - http://sourceforge.net/project/shownotes.php?release_id=372086&group_id=7322
- HP - HPSBUX02172
- HP - SSRT061269
- SECUNIA - 17659
- SECUNIA - 22669
- VUPEN - ADV-2005-2515

Vulnerable Software & Versions: (show all)

- cpe:/a:mortbay:jetty:4.2.27
- ...
- cpe:/a:mortbay:jetty:1.0
- cpe:/a:mortbay:jetty:1.0.1
- cpe:/a:mortbay:jetty:1.1
- cpe:/a:mortbay:jetty:1.1.1
- cpe:/a:mortbay:jetty:1.2.0
- cpe:/a:mortbay:jetty:1.3.0
- cpe:/a:mortbay:jetty:1.3.1
- cpe:/a:mortbay:jetty:1.3.2
- cpe:/a:mortbay:jetty:1.3.3
- cpe:/a:mortbay:jetty:1.3.4
- cpe:/a:mortbay:jetty:1.3.5
- cpe:/a:mortbay:jetty:2.0:alpha1
- cpe:/a:mortbay:jetty:2.0:alpha2
- cpe:/a:mortbay:jetty:2.0:beta1
- cpe:/a:mortbay:jetty:2.0:beta2
- cpe:/a:mortbay:jetty:2.0.0
- cpe:/a:mortbay:jetty:2.0.1
- cpe:/a:mortbay:jetty:2.0.2
- cpe:/a:mortbay:jetty:2.0.3
- cpe:/a:mortbay:jetty:2.0.4
- cpe:/a:mortbay:jetty:2.0.5
- cpe:/a:mortbay:jetty:2.1.0
- cpe:/a:mortbay:jetty:2.1.1
- cpe:/a:mortbay:jetty:2.1.2
- cpe:/a:mortbay:jetty:2.1.3
- cpe:/a:mortbay:jetty:2.1.4
- cpe:/a:mortbay:jetty:2.1.5
- cpe:/a:mortbay:jetty:2.1.6
- cpe:/a:mortbay:jetty:2.1.7
- cpe:/a:mortbay:jetty:2.1.b0
- cpe:/a:mortbay:jetty:2.1.b1
- cpe:/a:mortbay:jetty:2.2:alpha0
- cpe:/a:mortbay:jetty:2.2:alpha1
- cpe:/a:mortbay:jetty:2.2:beta0
- cpe:/a:mortbay:jetty:2.2:beta1
- cpe:/a:mortbay:jetty:2.2:beta2
- cpe:/a:mortbay:jetty:2.2:beta3
- cpe:/a:mortbay:jetty:2.2:beta4
- cpe:/a:mortbay:jetty:2.2.0
- cpe:/a:mortbay:jetty:2.2.1
- cpe:/a:mortbay:jetty:2.2.2
- cpe:/a:mortbay:jetty:2.2.3
- cpe:/a:mortbay:jetty:2.2.4
- cpe:/a:mortbay:jetty:2.2.5
- cpe:/a:mortbay:jetty:2.2.6
- cpe:/a:mortbay:jetty:2.2.7
- cpe:/a:mortbay:jetty:2.2.8
- cpe:/a:mortbay:jetty:2.3.0
- cpe:/a:mortbay:jetty:2.3.0a
- cpe:/a:mortbay:jetty:2.3.1
- cpe:/a:mortbay:jetty:2.3.2
- cpe:/a:mortbay:jetty:2.3.3
- cpe:/a:mortbay:jetty:2.3.4
- cpe:/a:mortbay:jetty:2.3.5
- cpe:/a:mortbay:jetty:2.4.0
- cpe:/a:mortbay:jetty:2.4.1
- cpe:/a:mortbay:jetty:2.4.2
- cpe:/a:mortbay:jetty:2.4.3
- cpe:/a:mortbay:jetty:2.4.4
- cpe:/a:mortbay:jetty:2.4.5
- cpe:/a:mortbay:jetty:2.4.6
- cpe:/a:mortbay:jetty:2.4.7
- cpe:/a:mortbay:jetty:2.4.8
- cpe:/a:mortbay:jetty:2.4.9
- cpe:/a:mortbay:jetty:3.0
- cpe:/a:mortbay:jetty:3.0.0
- cpe:/a:mortbay:jetty:3.0.0:rc1
- cpe:/a:mortbay:jetty:3.0.0:rc2
- cpe:/a:mortbay:jetty:3.0.0:rc3
- cpe:/a:mortbay:jetty:3.0.0:rc4
- cpe:/a:mortbay:jetty:3.0.0:rc5
- cpe:/a:mortbay:jetty:3.0.0:rc6
- cpe:/a:mortbay:jetty:3.0.0:rc7
- cpe:/a:mortbay:jetty:3.0.0:rc8
- cpe:/a:mortbay:jetty:3.0.1
- cpe:/a:mortbay:jetty:3.0.2
- cpe:/a:mortbay:jetty:3.0.3
- cpe:/a:mortbay:jetty:3.0.4
- cpe:/a:mortbay:jetty:3.0.5
- cpe:/a:mortbay:jetty:3.0.6
- cpe:/a:mortbay:jetty:3.0.a0
- cpe:/a:mortbay:jetty:3.0.a1
- cpe:/a:mortbay:jetty:3.0.a2
- cpe:/a:mortbay:jetty:3.0.a3
- cpe:/a:mortbay:jetty:3.0.a4
- cpe:/a:mortbay:jetty:3.0.a5
- cpe:/a:mortbay:jetty:3.0.a6
- cpe:/a:mortbay:jetty:3.0.a7
- cpe:/a:mortbay:jetty:3.0.a8
- cpe:/a:mortbay:jetty:3.0.a9
- cpe:/a:mortbay:jetty:3.0.a90
- cpe:/a:mortbay:jetty:3.0.a91
- cpe:/a:mortbay:jetty:3.0.a92
- cpe:/a:mortbay:jetty:3.0.a93
- cpe:/a:mortbay:jetty:3.0.a94
- cpe:/a:mortbay:jetty:3.0.a95
- cpe:/a:mortbay:jetty:3.0.a96
- cpe:/a:mortbay:jetty:3.0.a97
- cpe:/a:mortbay:jetty:3.0.a98
- cpe:/a:mortbay:jetty:3.0.a99
- cpe:/a:mortbay:jetty:3.0.b01
- cpe:/a:mortbay:jetty:3.0.b02
- cpe:/a:mortbay:jetty:3.0.b03
- cpe:/a:mortbay:jetty:3.0.b04
- cpe:/a:mortbay:jetty:3.0.b05
- cpe:/a:mortbay:jetty:3.1:rc0
- cpe:/a:mortbay:jetty:3.1:rc1
- cpe:/a:mortbay:jetty:3.1:rc2
- cpe:/a:mortbay:jetty:3.1:rc3
- cpe:/a:mortbay:jetty:3.1:rc4
- cpe:/a:mortbay:jetty:3.1:rc5
- cpe:/a:mortbay:jetty:3.1:rc6
- cpe:/a:mortbay:jetty:3.1:rc7
- cpe:/a:mortbay:jetty:3.1:rc8
- cpe:/a:mortbay:jetty:3.1:rc9
- cpe:/a:mortbay:jetty:3.1.0
- cpe:/a:mortbay:jetty:3.1.1
- cpe:/a:mortbay:jetty:3.1.2
- cpe:/a:mortbay:jetty:3.1.3
- cpe:/a:mortbay:jetty:3.1.4
- cpe:/a:mortbay:jetty:3.1.5
- cpe:/a:mortbay:jetty:3.1.6
- cpe:/a:mortbay:jetty:3.1.7
- cpe:/a:mortbay:jetty:3.1.8
- cpe:/a:mortbay:jetty:3.1.9
- cpe:/a:mortbay:jetty:4.0:rc1
- cpe:/a:mortbay:jetty:4.0:rc2
- cpe:/a:mortbay:jetty:4.0:rc3
- cpe:/a:mortbay:jetty:4.0.0
- cpe:/a:mortbay:jetty:4.0.1
- cpe:/a:mortbay:jetty:4.0.1:rc0
- cpe:/a:mortbay:jetty:4.0.1:rc1
- cpe:/a:mortbay:jetty:4.0.1:rc2
- cpe:/a:mortbay:jetty:4.0.2
- cpe:/a:mortbay:jetty:4.0.3
- cpe:/a:mortbay:jetty:4.0.4
- cpe:/a:mortbay:jetty:4.0.5
- cpe:/a:mortbay:jetty:4.0.6
- cpe:/a:mortbay:jetty:4.0.b0
- cpe:/a:mortbay:jetty:4.0.b1
- cpe:/a:mortbay:jetty:4.0.b2
- cpe:/a:mortbay:jetty:4.0.d0
- cpe:/a:mortbay:jetty:4.0.d1
- cpe:/a:mortbay:jetty:4.0.d2
- cpe:/a:mortbay:jetty:4.0.d3
- cpe:/a:mortbay:jetty:4.0.d4
- cpe:/a:mortbay:jetty:4.1.0
- cpe:/a:mortbay:jetty:4.1.0:rc0
- cpe:/a:mortbay:jetty:4.1.0:rc1
- cpe:/a:mortbay:jetty:4.1.0:rc2
- cpe:/a:mortbay:jetty:4.1.0:rc3
- cpe:/a:mortbay:jetty:4.1.0:rc4
- cpe:/a:mortbay:jetty:4.1.0:rc5
- cpe:/a:mortbay:jetty:4.1.0:rc6
- cpe:/a:mortbay:jetty:4.1.1
- cpe:/a:mortbay:jetty:4.1.2
- cpe:/a:mortbay:jetty:4.1.3
- cpe:/a:mortbay:jetty:4.1.4
- cpe:/a:mortbay:jetty:4.1.b0
- cpe:/a:mortbay:jetty:4.1.b1
- cpe:/a:mortbay:jetty:4.1.d0
- cpe:/a:mortbay:jetty:4.1.d1
- cpe:/a:mortbay:jetty:4.1.d2
- cpe:/a:mortbay:jetty:4.2
- cpe:/a:mortbay:jetty:4.2.0
- cpe:/a:mortbay:jetty:4.2.0:beta0
- cpe:/a:mortbay:jetty:4.2.0:rc0
- cpe:/a:mortbay:jetty:4.2.0:rc1
- cpe:/a:mortbay:jetty:4.2.1
- cpe:/a:mortbay:jetty:4.2.2
- cpe:/a:mortbay:jetty:4.2.3
- cpe:/a:mortbay:jetty:4.2.4
- cpe:/a:mortbay:jetty:4.2.4:rc0
- cpe:/a:mortbay:jetty:4.2.5
- cpe:/a:mortbay:jetty:4.2.6
- cpe:/a:mortbay:jetty:4.2.7
- cpe:/a:mortbay:jetty:4.2.9
- cpe:/a:mortbay:jetty:4.2.9:rc1
- cpe:/a:mortbay:jetty:4.2.9:rc2
- cpe:/a:mortbay:jetty:4.2.10
- cpe:/a:mortbay:jetty:4.2.10:pre0
- cpe:/a:mortbay:jetty:4.2.10:pre1
- cpe:/a:mortbay:jetty:4.2.10:pre2
- cpe:/a:mortbay:jetty:4.2.11
- cpe:/a:mortbay:jetty:4.2.12
- cpe:/a:mortbay:jetty:4.2.14
- cpe:/a:mortbay:jetty:4.2.14:rc0
- cpe:/a:mortbay:jetty:4.2.14:rc1
- cpe:/a:mortbay:jetty:4.2.15
- cpe:/a:mortbay:jetty:4.2.15:rc0
- cpe:/a:mortbay:jetty:4.2.16
- cpe:/a:mortbay:jetty:4.2.17
- cpe:/a:mortbay:jetty:4.2.18
- cpe:/a:mortbay:jetty:4.2.19
- cpe:/a:mortbay:jetty:4.2.20
- cpe:/a:mortbay:jetty:4.2.20:rc0
- cpe:/a:mortbay:jetty:4.2.21
- cpe:/a:mortbay:jetty:4.2.22
- cpe:/a:mortbay:jetty:4.2.23
- cpe:/a:mortbay:jetty:4.2.23:rc0
- cpe:/a:mortbay:jetty:4.2.24
- cpe:/a:mortbay:jetty:4.2.24:rc0
- cpe:/a:mortbay:jetty:4.2.24:rc1
- cpe:/a:mortbay:jetty:4.2.25
- cpe:/a:mortbay:jetty:4.2.26
- cpe:/a:mortbay:jetty:4.2.27
- cpe:/a:mortbay:jetty:4.2.8_01
- cpe:/a:mortbay:jetty:5.0:alpha0
- cpe:/a:mortbay:jetty:5.0:alpha1
- cpe:/a:mortbay:jetty:5.0:alpha2
- cpe:/a:mortbay:jetty:5.0:alpha3
- cpe:/a:mortbay:jetty:5.0:beta0
- cpe:/a:mortbay:jetty:5.0:beta1
- cpe:/a:mortbay:jetty:5.0:beta2
- cpe:/a:mortbay:jetty:5.0:rc1
- cpe:/a:mortbay:jetty:5.0:rc2
- cpe:/a:mortbay:jetty:5.0:rc3
- cpe:/a:mortbay:jetty:5.0:rc4
- cpe:/a:mortbay:jetty:5.0.0
- cpe:/a:mortbay:jetty:5.0.0:rc0
- cpe:/a:mortbay:jetty:5.1
- cpe:/a:mortbay:jetty:5.1.0
- cpe:/a:mortbay:jetty:5.1.1
- cpe:/a:mortbay:jetty:5.1.1:rc0
- cpe:/a:mortbay:jetty:5.1.1:rc1
- cpe:/a:mortbay:jetty:5.1.2
- cpe:/a:mortbay:jetty:5.1.2:pre0
- cpe:/a:mortbay:jetty:5.1.3
- cpe:/a:mortbay:jetty:5.1.3:rc0
- cpe:/a:mortbay:jetty:5.1.3:rc1
- cpe:/a:mortbay:jetty:5.1.3:rc2
- cpe:/a:mortbay:jetty:5.1.3:rc3
- cpe:/a:mortbay:jetty:5.1.3:rc4
- cpe:/a:mortbay:jetty:5.1.4
- cpe:/a:mortbay:jetty:5.1.4:rc0
- cpe:/a:mortbay:jetty:5.1.5
- cpe:/a:mortbay:jetty:5.1.5:rc0 and all previous versions
- cpe:/a:mortbay:jetty:5.1.5:rc1 and all previous versions
- cpe:/a:mortbay:jetty:5.1.5:rc2 and all previous versions
- cpe:/a:mortbay:jetty:5.1.11:rc0

### org.mortbay.jmx.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\org.mortbay.jmx.jar
MD5: 82d35b88a6caecb9ad5cc8a0ca2c6c81
SHA1: 938031afdf33d3c5fee6077312fb44be25a9725c

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | org.mortbay.jmx
jar | package name | jmx
jar | package name | mortbay

#### Identifiers

- None

### plexus-utils-3.0.7.jar

Description: A collection of various utility classes to ease working with strings, files, command lines, XML and more.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\plexus-utils-3.0.7.jar
MD5: c22b393490a46da89d91dd6322446e40
SHA1: eb10e9cb2b2326fbf0cb68249b10a5c89e0642ef

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | plexus-utils
central | groupid | org.codehaus.plexus
central | version | 3.0.7
file | name | plexus-utils
file | version | 3.0.7
jar | package name | codehaus
jar | package name | plexus
jar | package name | util
pom | artifactid | plexus-utils
pom | description | A collection of various utility classes to ease working with strings, files, command lines, XML and more.
pom | groupid | codehaus.plexus
pom | name | Plexus Common Utilities
pom | parent-artifactid | plexus
pom | parent-groupid | org.codehaus.plexus
pom | parent-version | 3.0.7
pom | url | http://plexus.codehaus.org/plexus-utils
pom | version | 3.0.7

#### Identifiers

- maven: org.codehaus.plexus:plexus-utils:3.0.7 Confidence:HIGHEST

### EggTest-0.0.1-py2.7.egg

Description: Simple project for producing an .egg.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\python\dist\EggTest-0.0.1-py2.7.egg
MD5: d314004a75bb4fe6907c016126ee0c7f
SHA1: 7cb9966e32f5d53564ec4c90868b31794ffa6130

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | EggTest
file | version | 0.0.1
METADATA | Author | Dale Visser
METADATA | Name | EggTest
METADATA | summary | Simple project for producing an .egg.
METADATA | vendor | http://example.org/eggtest
METADATA | Version | 0.0.1

#### Identifiers

- None

### Django-1.7.2-py2.py3-none-any.whl

Description: A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\python\Django-1.7.2-py2.py3-none-any.whl
MD5: dc54b224746c157e89df31c886412a40
SHA1: 3aff2fabdd09e00b51bd0522a2c3ad672958d361

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | Django
file | version | 1.7.2
METADATA | Author | Django Software Foundation
METADATA | Name | Django
METADATA | summary | A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
METADATA | vendor | http://www.djangoproject.com/
METADATA | Version | 1.7.2

#### Identifiers

- cpe: cpe:/a:django_project:django:1.7.2 Confidence:LOW
- cpe: cpe:/a:djangoproject:django:1.7.2 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2016-7401

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-254 Security Features

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

- BID - 93182
- CONFIRM - https://www.djangoproject.com/weblog/2016/sep/26/security-releases/
- DEBIAN - DSA-3678
- SECTRACK - 1036899
- UBUNTU - USN-3089-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.8.14 and all previous versions
- ...
- cpe:/a:djangoproject:django:1.8.14 and all previous versions
- cpe:/a:djangoproject:django:1.9.0
- cpe:/a:djangoproject:django:1.9.1
- cpe:/a:djangoproject:django:1.9.2
- cpe:/a:djangoproject:django:1.9.3
- cpe:/a:djangoproject:django:1.9.4
- cpe:/a:djangoproject:django:1.9.5
- cpe:/a:djangoproject:django:1.9.6
- cpe:/a:djangoproject:django:1.9.7
- cpe:/a:djangoproject:django:1.9.8
- cpe:/a:djangoproject:django:1.9.9

CVE-2016-6186

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.

- BUGTRAQ - 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186)
- CONFIRM - https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
- CONFIRM - https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d
- CONFIRM - https://www.djangoproject.com/weblog/2016/jul/18/security-releases/
- DEBIAN - DSA-3622
- FULLDISC - 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186)
- MISC - http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html
- MISC - http://www.vulnerability-lab.com/get_content.php?id=1869
- SECTRACK - 1036338
- UBUNTU - USN-3039-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.8.13 and all previous versions
- ...
- cpe:/a:djangoproject:django:1.8.13 and all previous versions
- cpe:/a:djangoproject:django:1.9
- cpe:/a:djangoproject:django:1.9.0:rc1
- cpe:/a:djangoproject:django:1.9.1
- cpe:/a:djangoproject:django:1.9.2
- cpe:/a:djangoproject:django:1.9.3
- cpe:/a:djangoproject:django:1.9.4
- cpe:/a:djangoproject:django:1.9.5
- cpe:/a:djangoproject:django:1.9.6
- cpe:/a:djangoproject:django:1.9.7
- cpe:/a:djangoproject:django:1.10:alpha1
- cpe:/a:djangoproject:django:1.10:beta1

CVE-2015-8213

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.

- CONFIRM - https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4
- CONFIRM - https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
- UBUNTU - USN-2816-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.10 and all previous versions
- ...
- cpe:/a:djangoproject:django:1.7.10 and all previous versions
- cpe:/a:djangoproject:django:1.8.0
- cpe:/a:djangoproject:django:1.8.1
- cpe:/a:djangoproject:django:1.8.2
- cpe:/a:djangoproject:django:1.8.3
- cpe:/a:djangoproject:django:1.8.4
- cpe:/a:djangoproject:django:1.8.5
- cpe:/a:djangoproject:django:1.8.6
- cpe:/a:djangoproject:django:1.9.0:rc1

CVE-2015-5964

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.

- MISC - https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
- UBUNTU - USN-2720-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4
- cpe:/a:djangoproject:django:1.4.1
- cpe:/a:djangoproject:django:1.4.2
- cpe:/a:djangoproject:django:1.4.4
- cpe:/a:djangoproject:django:1.4.5
- cpe:/a:djangoproject:django:1.4.6
- cpe:/a:djangoproject:django:1.4.7
- cpe:/a:djangoproject:django:1.4.8
- cpe:/a:djangoproject:django:1.4.9
- cpe:/a:djangoproject:django:1.4.10
- cpe:/a:djangoproject:django:1.4.11
- cpe:/a:djangoproject:django:1.4.12
- cpe:/a:djangoproject:django:1.4.13
- cpe:/a:djangoproject:django:1.4.14
- cpe:/a:djangoproject:django:1.4.17
- cpe:/a:djangoproject:django:1.4.19
- cpe:/a:djangoproject:django:1.4.20
- cpe:/a:djangoproject:django:1.4.21
- cpe:/a:djangoproject:django:1.7:beta1
- cpe:/a:djangoproject:django:1.7:beta2
- cpe:/a:djangoproject:django:1.7:beta3
- cpe:/a:djangoproject:django:1.7:beta4
- cpe:/a:djangoproject:django:1.7:rc1
- cpe:/a:djangoproject:django:1.7:rc2
- cpe:/a:djangoproject:django:1.7:rc3
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2
- cpe:/a:djangoproject:django:1.7.3
- cpe:/a:djangoproject:django:1.7.4
- cpe:/a:djangoproject:django:1.7.5
- cpe:/a:djangoproject:django:1.7.6
- cpe:/a:djangoproject:django:1.7.7
- cpe:/a:djangoproject:django:1.7.8
- cpe:/a:djangoproject:django:1.7.9
- cpe:/a:djangoproject:django:1.8:beta1
- cpe:/a:djangoproject:django:1.8.0
- cpe:/a:djangoproject:django:1.8.1
- cpe:/a:djangoproject:django:1.8.2
- cpe:/a:djangoproject:django:1.8.3

CVE-2015-5963

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

- MISC - https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
- UBUNTU - USN-2720-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4
- cpe:/a:djangoproject:django:1.4.1
- cpe:/a:djangoproject:django:1.4.2
- cpe:/a:djangoproject:django:1.4.4
- cpe:/a:djangoproject:django:1.4.5
- cpe:/a:djangoproject:django:1.4.6
- cpe:/a:djangoproject:django:1.4.7
- cpe:/a:djangoproject:django:1.4.8
- cpe:/a:djangoproject:django:1.4.9
- cpe:/a:djangoproject:django:1.4.10
- cpe:/a:djangoproject:django:1.4.11
- cpe:/a:djangoproject:django:1.4.12
- cpe:/a:djangoproject:django:1.4.13
- cpe:/a:djangoproject:django:1.4.14
- cpe:/a:djangoproject:django:1.4.17
- cpe:/a:djangoproject:django:1.4.19
- cpe:/a:djangoproject:django:1.4.20
- cpe:/a:djangoproject:django:1.4.21
- cpe:/a:djangoproject:django:1.7:beta1
- cpe:/a:djangoproject:django:1.7:beta2
- cpe:/a:djangoproject:django:1.7:beta3
- cpe:/a:djangoproject:django:1.7:beta4
- cpe:/a:djangoproject:django:1.7:rc1
- cpe:/a:djangoproject:django:1.7:rc2
- cpe:/a:djangoproject:django:1.7:rc3
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2
- cpe:/a:djangoproject:django:1.7.3
- cpe:/a:djangoproject:django:1.7.4
- cpe:/a:djangoproject:django:1.7.5
- cpe:/a:djangoproject:django:1.7.6
- cpe:/a:djangoproject:django:1.7.7
- cpe:/a:djangoproject:django:1.7.8
- cpe:/a:djangoproject:django:1.7.9
- cpe:/a:djangoproject:django:1.8:beta1
- cpe:/a:djangoproject:django:1.8.0
- cpe:/a:djangoproject:django:1.8.1
- cpe:/a:djangoproject:django:1.8.2
- cpe:/a:djangoproject:django:1.8.3

CVE-2015-5144

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.

- CONFIRM - https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- DEBIAN - DSA-3305
- UBUNTU - USN-2671-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.20 and all previous versions
- cpe:/a:djangoproject:django:1.5
- cpe:/a:djangoproject:django:1.5:alpha
- cpe:/a:djangoproject:django:1.5:beta
- cpe:/a:djangoproject:django:1.5.1
- cpe:/a:djangoproject:django:1.5.2
- cpe:/a:djangoproject:django:1.5.3
- cpe:/a:djangoproject:django:1.5.4
- cpe:/a:djangoproject:django:1.5.5
- cpe:/a:djangoproject:django:1.5.6
- cpe:/a:djangoproject:django:1.5.7
- cpe:/a:djangoproject:django:1.5.8
- cpe:/a:djangoproject:django:1.5.9
- cpe:/a:djangoproject:django:1.5.10
- cpe:/a:djangoproject:django:1.5.11
- cpe:/a:djangoproject:django:1.5.12
- cpe:/a:djangoproject:django:1.6:-
- cpe:/a:djangoproject:django:1.6:beta1
- cpe:/a:djangoproject:django:1.6:beta2
- cpe:/a:djangoproject:django:1.6:beta3
- cpe:/a:djangoproject:django:1.6:beta4
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.6.10
- cpe:/a:djangoproject:django:1.7:beta1
- cpe:/a:djangoproject:django:1.7:beta2
- cpe:/a:djangoproject:django:1.7:beta3
- cpe:/a:djangoproject:django:1.7:beta4
- cpe:/a:djangoproject:django:1.7:rc1
- cpe:/a:djangoproject:django:1.7:rc2
- cpe:/a:djangoproject:django:1.7:rc3
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2
- cpe:/a:djangoproject:django:1.7.3
- cpe:/a:djangoproject:django:1.7.4
- cpe:/a:djangoproject:django:1.7.5
- cpe:/a:djangoproject:django:1.7.6
- cpe:/a:djangoproject:django:1.7.7
- cpe:/a:djangoproject:django:1.7.8
- cpe:/a:djangoproject:django:1.7.9
- cpe:/a:djangoproject:django:1.8:beta1
- cpe:/a:djangoproject:django:1.8.0
- cpe:/a:djangoproject:django:1.8.1
- cpe:/a:djangoproject:django:1.8.2

CVE-2015-5143

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.

- CONFIRM - https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- DEBIAN - DSA-3305
- UBUNTU - USN-2671-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.20
- cpe:/a:djangoproject:django:1.5
- cpe:/a:djangoproject:django:1.5:alpha
- cpe:/a:djangoproject:django:1.5:beta
- cpe:/a:djangoproject:django:1.5.1
- cpe:/a:djangoproject:django:1.5.2
- cpe:/a:djangoproject:django:1.5.3
- cpe:/a:djangoproject:django:1.5.4
- cpe:/a:djangoproject:django:1.5.5
- cpe:/a:djangoproject:django:1.5.6
- cpe:/a:djangoproject:django:1.5.7
- cpe:/a:djangoproject:django:1.5.8
- cpe:/a:djangoproject:django:1.5.9
- cpe:/a:djangoproject:django:1.5.10
- cpe:/a:djangoproject:django:1.5.11
- cpe:/a:djangoproject:django:1.5.12
- cpe:/a:djangoproject:django:1.6:-
- cpe:/a:djangoproject:django:1.6:beta1
- cpe:/a:djangoproject:django:1.6:beta2
- cpe:/a:djangoproject:django:1.6:beta3
- cpe:/a:djangoproject:django:1.6:beta4
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.6.10
- cpe:/a:djangoproject:django:1.7:beta1
- cpe:/a:djangoproject:django:1.7:beta2
- cpe:/a:djangoproject:django:1.7:beta3
- cpe:/a:djangoproject:django:1.7:beta4
- cpe:/a:djangoproject:django:1.7:rc1
- cpe:/a:djangoproject:django:1.7:rc2
- cpe:/a:djangoproject:django:1.7:rc3
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2
- cpe:/a:djangoproject:django:1.7.3
- cpe:/a:djangoproject:django:1.7.4
- cpe:/a:djangoproject:django:1.7.5
- cpe:/a:djangoproject:django:1.7.6
- cpe:/a:djangoproject:django:1.7.7
- cpe:/a:djangoproject:django:1.7.8
- cpe:/a:djangoproject:django:1.7.9
- cpe:/a:djangoproject:django:1.8.0
- cpe:/a:djangoproject:django:1.8.1
- cpe:/a:djangoproject:django:1.8.2

CVE-2015-2317

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

- CONFIRM - https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
- DEBIAN - DSA-3204
- FEDORA - FEDORA-2015-5766
- MANDRIVA - MDVSA-2015:195
- SUSE - openSUSE-SU-2015:0643
- UBUNTU - USN-2539-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.19 and all previous versions
- cpe:/a:djangoproject:django:1.5
- cpe:/a:djangoproject:django:1.5:alpha
- cpe:/a:djangoproject:django:1.5:beta
- cpe:/a:djangoproject:django:1.5.1
- cpe:/a:djangoproject:django:1.5.2
- cpe:/a:djangoproject:django:1.5.3
- cpe:/a:djangoproject:django:1.5.4
- cpe:/a:djangoproject:django:1.5.5
- cpe:/a:djangoproject:django:1.5.6
- cpe:/a:djangoproject:django:1.5.7
- cpe:/a:djangoproject:django:1.5.8
- cpe:/a:djangoproject:django:1.5.9
- cpe:/a:djangoproject:django:1.5.10
- cpe:/a:djangoproject:django:1.5.11
- cpe:/a:djangoproject:django:1.5.12
- cpe:/a:djangoproject:django:1.6:-
- cpe:/a:djangoproject:django:1.6:beta1
- cpe:/a:djangoproject:django:1.6:beta2
- cpe:/a:djangoproject:django:1.6:beta3
- cpe:/a:djangoproject:django:1.6:beta4
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.6.10
- cpe:/a:djangoproject:django:1.7:beta1
- cpe:/a:djangoproject:django:1.7:beta2
- cpe:/a:djangoproject:django:1.7:beta3
- cpe:/a:djangoproject:django:1.7:beta4
- cpe:/a:djangoproject:django:1.7:rc1
- cpe:/a:djangoproject:django:1.7:rc2
- cpe:/a:djangoproject:django:1.7:rc3
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2
- cpe:/a:djangoproject:django:1.7.3
- cpe:/a:djangoproject:django:1.7.4
- cpe:/a:djangoproject:django:1.7.5
- cpe:/a:djangoproject:django:1.7.6
- cpe:/a:djangoproject:django:1.8.0

CVE-2015-2316

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.

- CONFIRM - https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
- FEDORA - FEDORA-2015-5766
- SUSE - openSUSE-SU-2015:0643
- UBUNTU - USN-2539-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.6:-
- cpe:/a:djangoproject:django:1.6:beta1
- cpe:/a:djangoproject:django:1.6:beta2
- cpe:/a:djangoproject:django:1.6:beta3
- cpe:/a:djangoproject:django:1.6:beta4
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.6.10
- cpe:/a:djangoproject:django:1.7:beta1
- cpe:/a:djangoproject:django:1.7:beta2
- cpe:/a:djangoproject:django:1.7:beta3
- cpe:/a:djangoproject:django:1.7:beta4
- cpe:/a:djangoproject:django:1.7:rc1
- cpe:/a:djangoproject:django:1.7:rc2
- cpe:/a:djangoproject:django:1.7:rc3
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2
- cpe:/a:djangoproject:django:1.7.3
- cpe:/a:djangoproject:django:1.7.4
- cpe:/a:djangoproject:django:1.7.5
- cpe:/a:djangoproject:django:1.7.6
- cpe:/a:djangoproject:django:1.8.0

CVE-2015-2241

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.

- CONFIRM - https://code.djangoproject.com/ticket/24461
- CONFIRM - https://www.djangoproject.com/weblog/2015/mar/09/security-releases/
- MANDRIVA - MDVSA-2015:109

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.5 and all previous versions
- ...
- cpe:/a:djangoproject:django:1.7.5 and all previous versions
- cpe:/a:djangoproject:django:1.8:beta1

CVE-2015-0222

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-17 Code

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.

- CONFIRM - http://advisories.mageia.org/MGASA-2015-0026.html
- CONFIRM - https://www.djangoproject.com/weblog/2015/jan/13/security/
- FEDORA - FEDORA-2015-0714
- FEDORA - FEDORA-2015-0790
- FEDORA - FEDORA-2015-0804
- MANDRIVA - MDVSA-2015:109
- SUSE - openSUSE-SU-2015:0643
- UBUNTU - USN-2469-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.17 and all previous versions
- cpe:/a:djangoproject:django:1.6
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.7
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2

CVE-2015-0221

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.

- CONFIRM - http://advisories.mageia.org/MGASA-2015-0026.html
- CONFIRM - https://www.djangoproject.com/weblog/2015/jan/13/security/
- FEDORA - FEDORA-2015-0714
- FEDORA - FEDORA-2015-0790
- FEDORA - FEDORA-2015-0804
- MANDRIVA - MDVSA-2015:036
- MANDRIVA - MDVSA-2015:109
- SUSE - openSUSE-SU-2015:0643
- UBUNTU - USN-2469-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.17 and all previous versions
- cpe:/a:djangoproject:django:1.6
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.7
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2

CVE-2015-0220

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

- CONFIRM - http://advisories.mageia.org/MGASA-2015-0026.html
- CONFIRM - https://www.djangoproject.com/weblog/2015/jan/13/security/
- FEDORA - FEDORA-2015-0714
- FEDORA - FEDORA-2015-0804
- MANDRIVA - MDVSA-2015:036
- MANDRIVA - MDVSA-2015:109
- SUSE - openSUSE-SU-2015:0643
- UBUNTU - USN-2469-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.17 and all previous versions
- cpe:/a:djangoproject:django:1.6
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.7
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2

CVE-2015-0219

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-17 Code

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

- CONFIRM - http://advisories.mageia.org/MGASA-2015-0026.html
- CONFIRM - https://www.djangoproject.com/weblog/2015/jan/13/security/
- FEDORA - FEDORA-2015-0714
- FEDORA - FEDORA-2015-0790
- FEDORA - FEDORA-2015-0804
- MANDRIVA - MDVSA-2015:036
- MANDRIVA - MDVSA-2015:109
- SUSE - openSUSE-SU-2015:0643
- UBUNTU - USN-2469-1

Vulnerable Software & Versions: (show all)

- cpe:/a:djangoproject:django:1.7.2
- ...
- cpe:/a:djangoproject:django:1.4.17 and all previous versions
- cpe:/a:djangoproject:django:1.6
- cpe:/a:djangoproject:django:1.6.1
- cpe:/a:djangoproject:django:1.6.2
- cpe:/a:djangoproject:django:1.6.3
- cpe:/a:djangoproject:django:1.6.4
- cpe:/a:djangoproject:django:1.6.5
- cpe:/a:djangoproject:django:1.6.6
- cpe:/a:djangoproject:django:1.6.7
- cpe:/a:djangoproject:django:1.6.8
- cpe:/a:djangoproject:django:1.6.9
- cpe:/a:djangoproject:django:1.7
- cpe:/a:djangoproject:django:1.7.1
- cpe:/a:djangoproject:django:1.7.2

### eggtest/__init__.py

Description: Simple project for producing an .egg.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\python\eggtest\__init__.py
MD5: ee53cac6173f2233cb2dd6dac4413b67
SHA1: e55fa8e5d163a2e3d1044d1bf17dd2c09d7f4d43

#### Evidence

Source | Name | Value
--- | --- | ---
__about__.py | SourceAuthor | Dale Visser
__about__.py | SourceTitle | EggTest
__about__.py | SourceVersion | 0.0.1
__about__.py | summary | Simple project for producing an .egg.
__about__.py | URL | http://example.org/eggtest
__init__.py | PackageName | eggtest

#### Identifiers

- None

### Django-1.7.2.dist-info/METADATA

Description: A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\python\site-packages\Django-1.7.2.dist-info\METADATA
MD5: d77b67751477ae5bfb425e707222c275
SHA1: 7f928e5ecbf0fa6d65d51d84d7d3abb3be7cf50d

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | METADATA
METADATA | Author | Django Software Foundation
METADATA | Name | Django
METADATA | summary | A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
METADATA | vendor | http://www.djangoproject.com/
METADATA | Version | 1.7.2

#### Identifiers

- cpe: cpe:/a:django_project:django:1.7.2 Confidence:LOW

### django/__init__.py

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\python\site-packages\django\__init__.py
MD5: 0e41218a36f1a34dd1a9544640f50f16
SHA1: 4c00f46811bb9586b41f349ce4b1588f606171cf

#### Evidence

Source | Name | Value
--- | --- | ---
__init__.py | PackageName | django

#### Identifiers

- None

### EGG-INFO/PKG-INFO

Description: Simple project for producing an .egg.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\python\site-packages\EggTest-0.0.1-py2.7.egg\EGG-INFO\PKG-INFO
MD5: 583b6174a81fc2428ea51510ea082a69
SHA1: 7b80ef725101822f447a3f85b39ed7f00263e98c

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | PKG-INFO
METADATA | Author | Dale Visser
METADATA | Name | EggTest
METADATA | summary | Simple project for producing an .egg.
METADATA | vendor | http://example.org/eggtest
METADATA | Version | 0.0.1

#### Identifiers

- None

### randomizedtesting-runner-2.0.13.jar

Description: Foundation classes and rules for applying the principles of Randomized Testing.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\randomizedtesting-runner-2.0.13.jar
MD5: 3fb3475e167953f6e33d17236f270953
SHA1: bdacac985583621c50de414b1d45b1e6e43f6d1f

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | randomizedtesting-runner
central | groupid | com.carrotsearch.randomizedtesting
central | version | 2.0.13
file | name | randomizedtesting-runner
file | version | 2.0.13
manifest | Bundle-Description | Foundation classes and rules for applying the principles of Randomized Testing.
Manifest | bundle-docurl | http://carrotsearch.com
Manifest | Bundle-Name | RandomizedTesting Randomized Runner
Manifest | bundle-requiredexecutionenvironment | JavaSE-1.6
Manifest | bundle-symbolicname | com.carrotsearch.randomizedtesting.randomizedtesting-runner
Manifest | Bundle-Version | 2.0.13
pom | artifactid | randomizedtesting-runner
pom | groupid | carrotsearch.randomizedtesting
pom | name | RandomizedTesting Randomized Runner
pom | parent-artifactid | randomizedtesting-parent
pom | parent-groupid | com.carrotsearch.randomizedtesting
pom | version | 2.0.13

#### Identifiers

- maven: com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.0.13 Confidence:HIGHEST

### regexp-1.3.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\regexp-1.3.jar
MD5: 6dcdc325850e40b843cac2a25fb2121e
SHA1: 973df2b78b67bcd3144c3dbbb88da691065a3f8d

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | regexp
central | groupid | regexp
central | version | 1.3
file | name | regexp
file | version | 1.3
jar | package name | apache
jar | package name | regexp
pom | artifactid | regexp
pom | groupid | regexp
pom | version | 1.3

#### Identifiers

- maven: regexp:regexp:1.3 Confidence:HIGHEST

### Gemfile.lock

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\rails-4.1.15\Gemfile.lock
MD5: 3c5baa06825e2a7d5c8a03010a3133c8
SHA1: e018b3bb1dd61e65799726afc2089ee22ce90f88

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | Gemfile

#### Identifiers

- None

### dalli-2.7.5.gemspec

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\rails-4.1.15\vendor\bundle\ruby\2.2.0\specifications\dalli-2.7.5.gemspec
MD5: 80f623e624660a26966428d7ea819b9d
SHA1: 4b47b6f5da978a2cedd4bf745d737770d6be2fde

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | dalli
file | version | 2.7.5
gemspec | author | Peter M. Goldstein, Mike Perham
gemspec | email | peter.m.goldstein@gmail.com, mperham@gmail.com
gemspec | homepage | https://github.com/petergoldstein/dalli
gemspec | license | MIT
gemspec | name | dalli
gemspec | name_project | dalli_project
gemspec | summary | High performance memcached client for Ruby
gemspec | version | 2.7.5

#### Identifiers

- None

### Gemfile.lock

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\sinatra\Gemfile.lock
MD5: 9c8c4ff99c58d504abedb155c5ac0cd3
SHA1: 565ccbd69c1e63619ea2e884e585589093dd070a

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | Gemfile

#### Identifiers

- None

### activerecord-oracle_enhanced-adapter-1.1.7.gemspec

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\activerecord-oracle_enhanced-adapter-1.1.7.gemspec
MD5: 147c9868415ea548eb32c1d73e90b5e2
SHA1: a421278b3c50c05cf426ab7e0e70990d6c65091d

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | activerecord-oracle_enhanced-adapter
file | version | 1.1.7
gemspec | author | Raimonds Simanovskis
gemspec | email | raymonds72@gmail.com
gemspec | homepage | http://oracle-enhanced.rubyforge.org
gemspec | name | activerecord-oracle_enhanced-adapter
gemspec | name_project | activerecord-oracle_enhanced-adapter_project
gemspec | summary | Oracle enhaced adapter for Active Record
gemspec | version | 1.1.7

#### Related Dependencies

- i18n-0.7.0.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\i18n-0.7.0.gemspec
  - SHA1: 0e665e7901fa0518cd522198da97a7445ab776b0
  - MD5: 82a151c9314b6aff02dfae455992d284
- mail-2.4.3.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\mail-2.4.3.gemspec
  - SHA1: 7a6163c3ba3dc1d788f66db53dd44c75ca80d5a7
  - MD5: 843ed646a6eac028b298b9525d534651
- mime-types-1.25.1.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\mime-types-1.25.1.gemspec
  - SHA1: 50922c422e3dbb16ab2881bcaec592ae5fc464ac
  - MD5: 046813fbc199c08336a760891d49597d
- netrc-0.10.3.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\netrc-0.10.3.gemspec
  - SHA1: 990f5d588c77a8a6197b4425df9b38c1554314d7
  - MD5: ed1f8e9ea49e4aeff755abed0df05c41
- polyglot-0.3.5.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\polyglot-0.3.5.gemspec
  - SHA1: 459c8f6cbac1b6a702b9abbc8e4b219ef71bc1cc
  - MD5: 48e8a4a87833f9d29b71461c91bfa70d
- rest-client-1.7.2.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\rest-client-1.7.2.gemspec
  - SHA1: 585e25376040a2057f03d45c15096dd4bb1ac96b
  - MD5: 3e8a6cc80a875f43a2aaddd275f4b8af
- treetop-1.4.15.gemspec
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\ruby\vulnerable\gems\specifications\treetop-1.4.15.gemspec
  - SHA1: 63dec5f1ae923ecee6bb8cdde972b6a8d416f0f5
  - MD5: af74a300e62d0e2292354810e9c9a6cd

#### Identifiers

- None

### serp-1.13.1.jar

Description: Serp is an open source framework for manipulating Java bytecode.

License:

    BSD: LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\serp-1.13.1.jar
MD5: f25cbd8e7d102a3f62cac34d8f623df5
SHA1: 737a7b53f80fa2a4265d647a9417bd9ea671a592

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | serp
central | groupid | net.sourceforge.serp
central | version | 1.13.1
file | name | serp
file | version | 1.13.1
jar | package name | bytecode
jar | package name | serp
pom | artifactid | serp
pom | description | Serp is an open source framework for manipulating Java bytecode.
pom | groupid | net.sourceforge.serp
pom | name | Serp
pom | url | http://serp.sourceforge.net
pom | version | 1.13.1

#### Identifiers

- maven: net.sourceforge.serp:serp:1.13.1 Confidence:HIGHEST

### servlet-api-2.5.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\servlet-api-2.5.jar
MD5: 69ca51af4e9a67a1027a7f95b52c3e8f
SHA1: 5959582d97d8b61f4d154ca9e495aafd16726e34

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | servlet-api
central | groupid | javax.servlet
central | version | 2.5
file | name | servlet-api
file | version | 2.5
jar | package name | javax
jar | package name | servlet
Manifest | extension-name | servlet-api
Manifest | Implementation-Title |
Manifest | Implementation-Vendor | Sun Microsystems Inc
Manifest | Implementation-Version | 2.5
Manifest | specification-title | A component of the Glassfish Application Server
Manifest | specification-vendor | Sun Microsystems Inc
pom | artifactid | servlet-api
pom | groupid | javax.servlet
pom | version | 2.5

#### Identifiers

- cpe: cpe:/a:sun:one_application_server:2.5 Confidence:LOW
- maven: javax.servlet:servlet-api:2.5 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2006-5654

Severity: Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Unspecified vulnerability in the Network Security Services (NSS) in Sun Java System Web Server 6.0 before SP 10 and ONE Application Server 7 before Update 3, when SSLv2 is enabled, allows remote authenticated users to cause a denial of service (application crash) via unspecified vectors. NOTE: due to lack of details from the vendor, it is unclear whether this is related to vector 1 in CVE-2006-5201 or CVE-2006-3127.

- BID - 20846
- SECTRACK - 1017143
- SECUNIA - 22646
- SUNALERT - 102670
- VUPEN - ADV-2006-4299
- XF - sun-java-nss-dos(29946)

Vulnerable Software & Versions: (show all)

- cpe:/a:sun:one_application_server:7.0:update_2 and all previous versions
- ...
- cpe:/a:sun:java_system_web_server:6.0:sp9
- cpe:/a:sun:one_application_server:7.0:update_2 and all previous versions

CVE-2006-3225

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)

Cross-site scripting (XSS) vulnerability in Sun ONE Application Server 7 before Update 9, Java System Application Server 7 2004Q2 before Update 5, and Java System Application Server Enterprise Edition 8.1 2005 Q1 allows remote attackers to inject arbitrary HTML or web script via unknown vectors.

- BID - 18635
- SECTRACK - 1016378
- SECUNIA - 20835
- SUNALERT - 102479
- VUPEN - ADV-2006-2508
- XF - sun-java-parameters-xss(27392)

Vulnerable Software & Versions: (show all)

- cpe:/a:sun:one_application_server:7.0:update_8 and all previous versions
- ...
- cpe:/a:sun:java_system_application_server:7.0:ur4 and all previous versions
- cpe:/a:sun:java_system_application_server:8.1::enterprise
- cpe:/a:sun:one_application_server:7.0:update_8 and all previous versions

CVE-2006-2501

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving error messages.

- BID - 18035
- CERT-VN - VU#114956
- JVN - JVN#03D5EAA8
- SECTRACK - 1016125
- SECTRACK - 1016126
- SECUNIA - 20147
- SUNALERT - 102164
- VUPEN - ADV-2006-1866
- XF - sun-java-system-xss(26550)

Vulnerable Software & Versions: (show all)

- cpe:/a:sun:one_application_server:7.0:update_6:platform and all previous versions
- ...
- cpe:/a:sun:java_system_application_server:7.0:ur2:enterprise and all previous versions
- cpe:/a:sun:java_system_application_server:7.0:ur2:standard and all previous versions
- cpe:/a:sun:java_system_web_server:6.1
- cpe:/a:sun:java_system_web_server:6.1:sp1 and all previous versions
- cpe:/a:sun:java_system_web_server:6.1:sp2 and all previous versions
- cpe:/a:sun:java_system_web_server:6.1:sp3 and all previous versions
- cpe:/a:sun:java_system_web_server:6.1:sp4 and all previous versions
- cpe:/a:sun:one_application_server:6.0
- cpe:/a:sun:one_application_server:6.0:sp1
- cpe:/a:sun:one_application_server:6.0:sp2
- cpe:/a:sun:one_application_server:7.0::platform and all previous versions
- cpe:/a:sun:one_application_server:7.0::standard and all previous versions
- cpe:/a:sun:one_application_server:7.0:update_6:platform and all previous versions
- cpe:/a:sun:one_application_server:7.0:update_6:standard and all previous versions
- cpe:/a:sun:one_web_server:6.0:sp3 and all previous versions
- cpe:/a:sun:one_web_server:6.0:sp4 and all previous versions
- cpe:/a:sun:one_web_server:6.0:sp5 and all previous versions
- cpe:/a:sun:one_web_server:6.0:sp7 and all previous versions
- cpe:/a:sun:one_web_server:6.0:sp8 and all previous versions
- cpe:/a:sun:one_web_server:6.0:sp9 and all previous versions

### slf4j-api-1.7.21.jar

Description: The slf4j API

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\slf4j-api-1.7.21.jar
MD5: c9be56284a92dcb2576679282eff80bf
SHA1: 139535a69a4239db087de9bab0bee568bf8e0b70

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | slf4j-api
central | groupid | org.slf4j
central | version | 1.7.21
file | name | slf4j-api
file | version | 1.7.21
manifest | Bundle-Description | The slf4j API
Manifest | Bundle-Name | slf4j-api
Manifest | bundle-requiredexecutionenvironment | J2SE-1.5
Manifest | bundle-symbolicname | slf4j.api
Manifest | Bundle-Version | 1.7.21
Manifest | Implementation-Title | slf4j-api
Manifest | Implementation-Version | 1.7.21
pom | artifactid | slf4j-api
pom | description | The slf4j API
pom | groupid | slf4j
pom | name | SLF4J API Module
pom | parent-artifactid | slf4j-parent
pom | parent-groupid | org.slf4j
pom | url | http://www.slf4j.org
pom | version | 1.7.21

#### Identifiers

- maven: org.slf4j:slf4j-api:1.7.21 Confidence:HIGHEST

### spring-aop-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-aop-3.0.0.RELEASE.jar
MD5: 67d9894cd97f071dd9839f92a280799b
SHA1: 395eff01b78c4d2190bc949225f6dc74d3a820b4

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-aop
central | groupid | org.springframework
central | version | 3.0.0.RELEASE
file | name | spring-aop
file | version | 3.0.0
jar | package name | aop
jar | package name | springframework
Manifest | Bundle-Name | Spring AOP
Manifest | bundle-symbolicname | org.springframework.aop
Manifest | Bundle-Version | 3.0.0.RELEASE
Manifest | ignored-existing-headers | Bnd-LastModified,Import-Package,Export-Package,Tool
Manifest | Implementation-Title | org.springframework.aop
Manifest | Implementation-Version | 3.0.0.RELEASE
Manifest | import-template | com.jamonapi.*;version="[2.4.0, 3.0.0)";resolution:=optional,net.sf.cglib.*;version="[2.1.3, 3.0.0)";resolution:=optional,org.aopalliance.*;version="[1.0.0, 2.0.0)",org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",org.apache.commons.pool.*;version="[1.3.0, 2.0.0)";resolution:=optional,org.aspectj.*;version="[1.5.4, 2.0.0)";resolution:=optional,org.springframework.beans.*;version="[3.0.0, 3.0.1)";resolution:=optional,org.springframework.core.*;version="[3.0.0, 3.0.1)",org.springframework.util.*;version="[3.0.0, 3.0.1)",org.w3c.dom.*;version="0";resolution:=optional
pom | artifactid | spring-aop
pom | groupid | springframework
pom | parent-artifactid | spring-parent
pom | parent-groupid | org.springframework
pom | version | 3.0.0.RELEASE

#### Identifiers

- maven: org.springframework:spring-aop:3.0.0.RELEASE Confidence:HIGHEST

### spring-asm-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-asm-3.0.0.RELEASE.jar
MD5: c92d22fa8aa9ff22c3087db016060682
SHA1: e5d8571c27128045f119d793b5e277256d9e39c7

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-asm
central | groupid | org.springframework
central | version | 3.0.0.RELEASE
file | name | spring-asm
file | version | 3.0.0
jar | package name | asm
jar | package name | springframework
Manifest | Bundle-Name | Spring ASM
Manifest | bundle-symbolicname | org.springframework.asm
Manifest | Bundle-Version | 3.0.0.RELEASE
Manifest | ignored-existing-headers | Import-Package
Manifest | Implementation-Title | org.springframework.asm
Manifest | Implementation-Vendor | France Telecom R&D
Manifest | Implementation-Version | 3.0.0.RELEASE
pom | artifactid | spring-asm
pom | groupid | springframework
pom | parent-artifactid | spring-parent
pom | parent-groupid | org.springframework
pom | version | 3.0.0.RELEASE

#### Identifiers

- maven: org.springframework:spring-asm:3.0.0.RELEASE Confidence:HIGHEST

### spring-core-2.5.5.jar

Description: Spring Framework: Core

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-core-2.5.5.jar
MD5: 05432ef3bf4efa1394b127563cb1dd8c
SHA1: 1b3b0fad8e30ebb9560a81989f5b5bfb28915109

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-core
central | groupid | org.springframework
central | version | 2.5.5
file | name | spring-core
file | version | 2.5.5
hint analyzer | product | springsource_spring_framework
hint analyzer | vendor | pivotal software
hint analyzer | vendor | SpringSource
hint analyzer | vendor | vmware
jar | package name | core
jar | package name | springframework
manifest | Bundle-Description | Spring Framework
Manifest | Bundle-Name | spring-core
Manifest | bundle-symbolicname | org.springframework.bundle.spring.core
Manifest | Bundle-Version | 2.5.5
Manifest | Implementation-Title | Spring Framework
Manifest | Implementation-Version | 2.5.5
Manifest | originally-created-by | 10.0-b22 (Sun Microsystems Inc.)
Manifest | spring-version | 2.5.5
pom | artifactid | spring-core
pom | description | Spring Framework: Core
pom | groupid | springframework
pom | name | Spring Framework: Core
pom | organization name | http://www.springframework.org/
pom | url | http://www.springframework.org
pom | version | 2.5.5

#### Related Dependencies

- spring-beans-2.5.5.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-beans-2.5.5.jar
  - SHA1: 6dc365922794e122bd2fbe102bc42de60fe8a744
  - MD5: 896ad6663df2b475596cf859407ba7c0
  - maven: org.springframework:spring-beans:2.5.5
- spring-context-2.5.5.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-context-2.5.5.jar
  - SHA1: e3676c2f4c662bae8dce52d38777f858b09c718c
  - MD5: d7ea8f5bba02875e5a6fbc8d8f5d493a
  - maven: org.springframework:spring-context:2.5.5
- spring-context-support-2.5.5.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-context-support-2.5.5.jar
  - SHA1: 61232b2857ad226468939a50e07206310b0a943c
  - MD5: 3414222f5157fd98abba64f674bc09eb
  - maven: org.springframework:spring-context-support:2.5.5
- spring-web-2.5.5.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-web-2.5.5.jar
  - SHA1: f746fd72635f94db9ae9e4dcdc95e4a81a15a5ac
  - MD5: dba137b0654dfe69fdb53b15e938e065
  - maven: org.springframework:spring-web:2.5.5
- spring-webmvc-2.5.5.jar
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-webmvc-2.5.5.jar
  - SHA1: 2b327d1e48e3ead4d85be1c9a9c5e5b137d5ccdf
  - MD5: 4865bae59f02a8d4bd1e46f84b5acec7
  - maven: org.springframework:spring-webmvc:2.5.5

#### Identifiers

- cpe: cpe:/a:pivotal:spring_framework:2.5.5 Confidence:LOW
- cpe: cpe:/a:pivotal_software:spring_framework:2.5.5 Confidence:LOW
- cpe: cpe:/a:springsource:spring_framework:2.5.5 Confidence:HIGHEST
- cpe: cpe:/a:vmware:springsource_spring_framework:2.5.5 Confidence:LOW
- maven: org.springframework:spring-core:2.5.5 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2014-1904

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

- BID - 66137
- BUGTRAQ - 20140311 CVE-2014-1904 XSS when using Spring MVC
- CONFIRM - http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt
- CONFIRM - http://www.gopivotal.com/security/cve-2014-1904
- CONFIRM - https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485
- CONFIRM - https://jira.springsource.org/browse/SPR-11426
- FULLDISC - 20140312 CVE-2014-1904 XSS when using Spring MVC
- REDHAT - RHSA-2014:0400

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:4.0.1 and all previous versions
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3
- cpe:/a:springsource:spring_framework:3.2.4
- cpe:/a:springsource:spring_framework:3.2.5
- cpe:/a:springsource:spring_framework:3.2.6
- cpe:/a:springsource:spring_framework:3.2.7 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2
- cpe:/a:springsource:spring_framework:4.0.0:rc1
- cpe:/a:springsource:spring_framework:4.0.1 and all previous versions

CVE-2014-0054

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-352

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

- CONFIRM - https://jira.spring.io/browse/SPR-11376
- REDHAT - RHSA-2014:0400

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.2.7 and all previous versions
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3
- cpe:/a:springsource:spring_framework:3.2.4
- cpe:/a:springsource:spring_framework:3.2.5
- cpe:/a:springsource:spring_framework:3.2.6
- cpe:/a:springsource:spring_framework:3.2.7 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2
- cpe:/a:springsource:spring_framework:4.0.0:rc1
- cpe:/a:springsource:spring_framework:4.0.1

CVE-2013-7315

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

- BUGTRAQ - 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework
- CONFIRM - http://www.gopivotal.com/security/cve-2013-4152
- CONFIRM - https://jira.springsource.org/browse/SPR-10806
- DEBIAN - DSA-2842
- FULLDISC - 20131102 XXE Injection in Spring Framework

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.2.3 and all previous versions
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2

CVE-2013-6429

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

- BUGTRAQ - 20140114 CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete
- CONFIRM - http://www.gopivotal.com/security/cve-2013-6429
- CONFIRM - https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel
- REDHAT - RHSA-2014:0400
- SECUNIA - 57915

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:2.5.5
- ...
- cpe:/a:springsource:spring_framework:1.1.0
- cpe:/a:springsource:spring_framework:2.0
- cpe:/a:springsource:spring_framework:2.0:m1
- cpe:/a:springsource:spring_framework:2.0:m2
- cpe:/a:springsource:spring_framework:2.0:m3
- cpe:/a:springsource:spring_framework:2.0:m4
- cpe:/a:springsource:spring_framework:2.0:m5
- cpe:/a:springsource:spring_framework:2.0:rc1
- cpe:/a:springsource:spring_framework:2.0:rc2
- cpe:/a:springsource:spring_framework:2.0:rc3
- cpe:/a:springsource:spring_framework:2.0:rc4
- cpe:/a:springsource:spring_framework:2.0.1
- cpe:/a:springsource:spring_framework:2.0.2
- cpe:/a:springsource:spring_framework:2.0.3
- cpe:/a:springsource:spring_framework:2.0.4
- cpe:/a:springsource:spring_framework:2.0.5
- cpe:/a:springsource:spring_framework:2.1:m1
- cpe:/a:springsource:spring_framework:2.1:m2
- cpe:/a:springsource:spring_framework:2.1:m3
- cpe:/a:springsource:spring_framework:2.1:m4
- cpe:/a:springsource:spring_framework:2.5.0
- cpe:/a:springsource:spring_framework:2.5.0:rc1
- cpe:/a:springsource:spring_framework:2.5.0:rc2
- cpe:/a:springsource:spring_framework:2.5.1
- cpe:/a:springsource:spring_framework:2.5.2
- cpe:/a:springsource:spring_framework:2.5.3
- cpe:/a:springsource:spring_framework:2.5.4
- cpe:/a:springsource:spring_framework:2.5.5
- cpe:/a:springsource:spring_framework:2.5.6
- cpe:/a:springsource:spring_framework:2.5.7
- cpe:/a:springsource:spring_framework:2.5.7_sr01
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3
- cpe:/a:springsource:spring_framework:3.2.4 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2
- cpe:/a:springsource:spring_framework:4.0.0:rc1

CVE-2013-4152

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

- BUGTRAQ - 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework
- CONFIRM - http://www.gopivotal.com/security/cve-2013-4152
- CONFIRM - https://github.com/spring-projects/spring-framework/pull/317/files
- CONFIRM - https://jira.springsource.org/browse/SPR-10806
- DEBIAN - DSA-2842
- FULLDISC - 20131102 XXE Injection in Spring Framework
- REDHAT - RHSA-2014:0212
- REDHAT - RHSA-2014:0245
- REDHAT - RHSA-2014:0254
- REDHAT - RHSA-2014:0400
- SECUNIA - 56247
- SECUNIA - 57915

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.2.3 and all previous versions
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1

CVE-2011-2730

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-16 Configuration

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

- CONFIRM - http://support.springsource.com/security/cve-2011-2730
- DEBIAN - DSA-2504
- MISC - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
- MISC - https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit
- REDHAT - RHSA-2013:0191
- REDHAT - RHSA-2013:0192
- REDHAT - RHSA-2013:0193
- REDHAT - RHSA-2013:0194
- REDHAT - RHSA-2013:0195
- REDHAT - RHSA-2013:0196
- REDHAT - RHSA-2013:0197
- REDHAT - RHSA-2013:0198
- REDHAT - RHSA-2013:0221
- SECTRACK - 1029151
- SECUNIA - 51984
- SECUNIA - 52054
- SECUNIA - 55155

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:2.5.5
- ...
- cpe:/a:springsource:spring_framework:2.5.0
- cpe:/a:springsource:spring_framework:2.5.0:rc1
- cpe:/a:springsource:spring_framework:2.5.0:rc2
- cpe:/a:springsource:spring_framework:2.5.1
- cpe:/a:springsource:spring_framework:2.5.2
- cpe:/a:springsource:spring_framework:2.5.3
- cpe:/a:springsource:spring_framework:2.5.4
- cpe:/a:springsource:spring_framework:2.5.5
- cpe:/a:springsource:spring_framework:2.5.6
- cpe:/a:springsource:spring_framework:2.5.7
- cpe:/a:springsource:spring_framework:2.5.7_sr01 and all previous versions
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5 and all previous versions

CVE-2010-1622

Severity: Medium
CVSS Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

- BID - 40954
- BUGTRAQ - 20100618 CVE-2010-1622: Spring Framework execution of arbitrary code
- CONFIRM - http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
- CONFIRM - http://geronimo.apache.org/21x-security-report.html
- CONFIRM - http://geronimo.apache.org/22x-security-report.html
- CONFIRM - http://www.springsource.com/security/cve-2010-1622
- EXPLOIT-DB - 13918
- REDHAT - RHSA-2011:0175
- SECUNIA - 41016
- SECUNIA - 41025
- SECUNIA - 43087
- VUPEN - ADV-2011-0237

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:2.5.5
- ...
- cpe:/a:springsource:spring_framework:2.5.0
- cpe:/a:springsource:spring_framework:2.5.1
- cpe:/a:springsource:spring_framework:2.5.2
- cpe:/a:springsource:spring_framework:2.5.3
- cpe:/a:springsource:spring_framework:2.5.4
- cpe:/a:springsource:spring_framework:2.5.5
- cpe:/a:springsource:spring_framework:2.5.6
- cpe:/a:springsource:spring_framework:2.5.7
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2

### spring-core-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-core-3.0.0.RELEASE.jar
MD5: 2d52a505f093291e4a2c7e1a28f34557
SHA1: 4f268922155ff53fb7b28aeca24fb28d5a439d95

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-core
central | groupid | org.springframework
central | version | 3.0.0.RELEASE
file | name | spring-core
file | version | 3.0.0
hint analyzer | product | springsource_spring_framework
hint analyzer | vendor | pivotal software
hint analyzer | vendor | SpringSource
hint analyzer | vendor | vmware
jar | package name | core
jar | package name | springframework
Manifest | Bundle-Name | Spring Core
Manifest | bundle-symbolicname | org.springframework.core
Manifest | Bundle-Version | 3.0.0.RELEASE
Manifest | ignored-existing-headers | Bnd-LastModified,Import-Package,Export-Package,Tool
Manifest | Implementation-Title | org.springframework.core
Manifest | Implementation-Version | 3.0.0.RELEASE
Manifest | import-template | javax.xml.*;version="0";resolution:=optional,org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",org.springframework.asm.*;version="[3.0.0, 3.0.1)";resolution:=optional,org.apache.log4j.*;version="[1.2.15, 2.0.0)";resolution:=optional,org.aspectj.*;version="[1.5.4, 2.0.0)";resolution:=optional,org.jboss.virtual.*;version="[2.1.0.GA, 3.0.0)";resolution:=optional,org.xml.sax.*;version="0";resolution:=optional,org.w3c.dom.*;version="0";resolution:=optional
pom | artifactid | spring-core
pom | groupid | springframework
pom | parent-artifactid | spring-parent
pom | parent-groupid | org.springframework
pom | version | 3.0.0.RELEASE

#### Identifiers

- cpe: cpe:/a:pivotal:spring_framework:3.0.0 Confidence:LOW
- cpe: cpe:/a:pivotal_software:spring_framework:3.0.0 Confidence:LOW
- cpe: cpe:/a:springsource:spring_framework:3.0.0 Confidence:HIGHEST
- cpe: cpe:/a:vmware:springsource_spring_framework:3.0.0 Confidence:HIGHEST
- maven: org.springframework:spring-core:3.0.0.RELEASE Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2014-1904

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

- BID - 66137
- BUGTRAQ - 20140311 CVE-2014-1904 XSS when using Spring MVC
- CONFIRM - http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt
- CONFIRM - http://www.gopivotal.com/security/cve-2014-1904
- CONFIRM - https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485
- CONFIRM - https://jira.springsource.org/browse/SPR-11426
- FULLDISC - 20140312 CVE-2014-1904 XSS when using Spring MVC
- REDHAT - RHSA-2014:0400

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3
- cpe:/a:springsource:spring_framework:3.2.4
- cpe:/a:springsource:spring_framework:3.2.5
- cpe:/a:springsource:spring_framework:3.2.6
- cpe:/a:springsource:spring_framework:3.2.7 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2
- cpe:/a:springsource:spring_framework:4.0.0:rc1
- cpe:/a:springsource:spring_framework:4.0.1 and all previous versions

CVE-2014-0054

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-352

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

- CONFIRM - https://jira.spring.io/browse/SPR-11376
- REDHAT - RHSA-2014:0400

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3
- cpe:/a:springsource:spring_framework:3.2.4
- cpe:/a:springsource:spring_framework:3.2.5
- cpe:/a:springsource:spring_framework:3.2.6
- cpe:/a:springsource:spring_framework:3.2.7 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2
- cpe:/a:springsource:spring_framework:4.0.0:rc1
- cpe:/a:springsource:spring_framework:4.0.1

CVE-2013-7315

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

- BUGTRAQ - 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework
- CONFIRM - http://www.gopivotal.com/security/cve-2013-4152
- CONFIRM - https://jira.springsource.org/browse/SPR-10806
- DEBIAN - DSA-2842
- FULLDISC - 20131102 XXE Injection in Spring Framework

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2

CVE-2013-6429

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

- BUGTRAQ - 20140114 CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete
- CONFIRM - http://www.gopivotal.com/security/cve-2013-6429
- CONFIRM - https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel
- REDHAT - RHSA-2014:0400
- SECUNIA - 57915

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:1.1.0
- cpe:/a:springsource:spring_framework:2.0
- cpe:/a:springsource:spring_framework:2.0:m1
- cpe:/a:springsource:spring_framework:2.0:m2
- cpe:/a:springsource:spring_framework:2.0:m3
- cpe:/a:springsource:spring_framework:2.0:m4
- cpe:/a:springsource:spring_framework:2.0:m5
- cpe:/a:springsource:spring_framework:2.0:rc1
- cpe:/a:springsource:spring_framework:2.0:rc2
- cpe:/a:springsource:spring_framework:2.0:rc3
- cpe:/a:springsource:spring_framework:2.0:rc4
- cpe:/a:springsource:spring_framework:2.0.1
- cpe:/a:springsource:spring_framework:2.0.2
- cpe:/a:springsource:spring_framework:2.0.3
- cpe:/a:springsource:spring_framework:2.0.4
- cpe:/a:springsource:spring_framework:2.0.5
- cpe:/a:springsource:spring_framework:2.1:m1
- cpe:/a:springsource:spring_framework:2.1:m2
- cpe:/a:springsource:spring_framework:2.1:m3
- cpe:/a:springsource:spring_framework:2.1:m4
- cpe:/a:springsource:spring_framework:2.5.0
- cpe:/a:springsource:spring_framework:2.5.0:rc1
- cpe:/a:springsource:spring_framework:2.5.0:rc2
- cpe:/a:springsource:spring_framework:2.5.1
- cpe:/a:springsource:spring_framework:2.5.2
- cpe:/a:springsource:spring_framework:2.5.3
- cpe:/a:springsource:spring_framework:2.5.4
- cpe:/a:springsource:spring_framework:2.5.5
- cpe:/a:springsource:spring_framework:2.5.6
- cpe:/a:springsource:spring_framework:2.5.7
- cpe:/a:springsource:spring_framework:2.5.7_sr01
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3
- cpe:/a:springsource:spring_framework:3.2.4 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1
- cpe:/a:springsource:spring_framework:4.0.0:m2
- cpe:/a:springsource:spring_framework:4.0.0:rc1

CVE-2013-4152

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

- BUGTRAQ - 20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework
- CONFIRM - http://www.gopivotal.com/security/cve-2013-4152
- CONFIRM - https://github.com/spring-projects/spring-framework/pull/317/files
- CONFIRM - https://jira.springsource.org/browse/SPR-10806
- DEBIAN - DSA-2842
- FULLDISC - 20131102 XXE Injection in Spring Framework
- REDHAT - RHSA-2014:0212
- REDHAT - RHSA-2014:0245
- REDHAT - RHSA-2014:0254
- REDHAT - RHSA-2014:0400
- SECUNIA - 56247
- SECUNIA - 57915

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.0:m1
- cpe:/a:springsource:spring_framework:3.0.0:m2
- cpe:/a:springsource:spring_framework:3.0.0:m3
- cpe:/a:springsource:spring_framework:3.0.0:m4
- cpe:/a:springsource:spring_framework:3.0.0:rc1
- cpe:/a:springsource:spring_framework:3.0.0:rc2
- cpe:/a:springsource:spring_framework:3.0.0:rc3
- cpe:/a:springsource:spring_framework:3.0.0.m1
- cpe:/a:springsource:spring_framework:3.0.0.m2
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5
- cpe:/a:springsource:spring_framework:3.0.6
- cpe:/a:springsource:spring_framework:3.0.7
- cpe:/a:springsource:spring_framework:3.1.0
- cpe:/a:springsource:spring_framework:3.1.1
- cpe:/a:springsource:spring_framework:3.1.2
- cpe:/a:springsource:spring_framework:3.1.3
- cpe:/a:springsource:spring_framework:3.1.4
- cpe:/a:springsource:spring_framework:3.2.0
- cpe:/a:springsource:spring_framework:3.2.1
- cpe:/a:springsource:spring_framework:3.2.2
- cpe:/a:springsource:spring_framework:3.2.3 and all previous versions
- cpe:/a:springsource:spring_framework:4.0.0:m1

CVE-2011-2894

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

- BID - 49536
- BUGTRAQ - 20110909 CVE-2011-2894: Spring Framework and Spring Security serialization-based remoting vulnerabilities
- CONFIRM - http://www.springsource.com/security/cve-2011-2894
- OSVDB - 75263
- REDHAT - RHSA-2011:1334
- SREASON - 8405
- XF - spring-framework-object-sec-bypass(69687)

Vulnerable Software & Versions: (show all)

- cpe:/a:vmware:springsource_spring_framework:3.0.0
- ...
- cpe:/a:vmware:springsource_spring_framework:3.0.0
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m1
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m2
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m3
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m4
- cpe:/a:vmware:springsource_spring_framework:3.0.0:rc1
- cpe:/a:vmware:springsource_spring_framework:3.0.0:rc2
- cpe:/a:vmware:springsource_spring_framework:3.0.0:rc3
- cpe:/a:vmware:springsource_spring_framework:3.0.1
- cpe:/a:vmware:springsource_spring_framework:3.0.2
- cpe:/a:vmware:springsource_spring_framework:3.0.3
- cpe:/a:vmware:springsource_spring_framework:3.0.4
- cpe:/a:vmware:springsource_spring_framework:3.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.0
- cpe:/a:vmware:springsource_spring_security:2.0.1
- cpe:/a:vmware:springsource_spring_security:2.0.2
- cpe:/a:vmware:springsource_spring_security:2.0.3
- cpe:/a:vmware:springsource_spring_security:2.0.4
- cpe:/a:vmware:springsource_spring_security:2.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.6
- cpe:/a:vmware:springsource_spring_security:3.0.0
- cpe:/a:vmware:springsource_spring_security:3.0.1
- cpe:/a:vmware:springsource_spring_security:3.0.2
- cpe:/a:vmware:springsource_spring_security:3.0.3
- cpe:/a:vmware:springsource_spring_security:3.0.4
- cpe:/a:vmware:springsource_spring_security:3.0.5

CVE-2011-2730

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-16 Configuration

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

- CONFIRM - http://support.springsource.com/security/cve-2011-2730
- DEBIAN - DSA-2504
- MISC - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
- MISC - https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit
- REDHAT - RHSA-2013:0191
- REDHAT - RHSA-2013:0192
- REDHAT - RHSA-2013:0193
- REDHAT - RHSA-2013:0194
- REDHAT - RHSA-2013:0195
- REDHAT - RHSA-2013:0196
- REDHAT - RHSA-2013:0197
- REDHAT - RHSA-2013:0198
- REDHAT - RHSA-2013:0221
- SECTRACK - 1029151
- SECUNIA - 51984
- SECUNIA - 52054
- SECUNIA - 55155

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:2.5.0
- cpe:/a:springsource:spring_framework:2.5.0:rc1
- cpe:/a:springsource:spring_framework:2.5.0:rc2
- cpe:/a:springsource:spring_framework:2.5.1
- cpe:/a:springsource:spring_framework:2.5.2
- cpe:/a:springsource:spring_framework:2.5.3
- cpe:/a:springsource:spring_framework:2.5.4
- cpe:/a:springsource:spring_framework:2.5.5
- cpe:/a:springsource:spring_framework:2.5.6
- cpe:/a:springsource:spring_framework:2.5.7
- cpe:/a:springsource:spring_framework:2.5.7_sr01 and all previous versions
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2
- cpe:/a:springsource:spring_framework:3.0.3
- cpe:/a:springsource:spring_framework:3.0.4
- cpe:/a:springsource:spring_framework:3.0.5 and all previous versions

CVE-2010-1622

Severity: Medium
CVSS Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

- BID - 40954
- BUGTRAQ - 20100618 CVE-2010-1622: Spring Framework execution of arbitrary code
- CONFIRM - http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
- CONFIRM - http://geronimo.apache.org/21x-security-report.html
- CONFIRM - http://geronimo.apache.org/22x-security-report.html
- CONFIRM - http://www.springsource.com/security/cve-2010-1622
- EXPLOIT-DB - 13918
- REDHAT - RHSA-2011:0175
- SECUNIA - 41016
- SECUNIA - 41025
- SECUNIA - 43087
- VUPEN - ADV-2011-0237

Vulnerable Software & Versions: (show all)

- cpe:/a:springsource:spring_framework:3.0.0
- ...
- cpe:/a:springsource:spring_framework:2.5.0
- cpe:/a:springsource:spring_framework:2.5.1
- cpe:/a:springsource:spring_framework:2.5.2
- cpe:/a:springsource:spring_framework:2.5.3
- cpe:/a:springsource:spring_framework:2.5.4
- cpe:/a:springsource:spring_framework:2.5.5
- cpe:/a:springsource:spring_framework:2.5.6
- cpe:/a:springsource:spring_framework:2.5.7
- cpe:/a:springsource:spring_framework:3.0.0
- cpe:/a:springsource:spring_framework:3.0.1
- cpe:/a:springsource:spring_framework:3.0.2

### spring-expression-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-expression-3.0.0.RELEASE.jar
MD5: eb2414ee8ed573139038ccecd9f76e0e
SHA1: b98f80c3f03fbffa16f9256df9bae34dae5df08c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-expression
central | groupid | org.springframework
central | version | 3.0.0.RELEASE
file | name | spring-expression
file | version | 3.0.0
jar | package name | expression
jar | package name | spel
jar | package name | springframework
Manifest | Bundle-Name | Spring Expression Language
Manifest | bundle-symbolicname | org.springframework.expression
Manifest | Bundle-Version | 3.0.0.RELEASE
Manifest | Implementation-Title | org.springframework.expression
Manifest | Implementation-Version | 3.0.0.RELEASE
Manifest | import-template | org.apache.commons.logging;version="[1.1.1, 2.0.0)",org.springframework.core.*;version="[3.0.0, 3.0.1)",org.springframework.util.*;version="[3.0.0, 3.0.1)"
pom | artifactid | spring-expression
pom | groupid | springframework
pom | parent-artifactid | spring-parent
pom | parent-groupid | org.springframework
pom | version | 3.0.0.RELEASE

#### Identifiers

- maven: org.springframework:spring-expression:3.0.0.RELEASE Confidence:HIGHEST

### spring-retry-1.1.0.RELEASE.jar

Description: Spring Retry provides an abstraction around retrying failed operations, with an emphasis on declarative control of the process and policy-based bahaviour that is easy to extend and customize. For instance, you can configure a plain POJO operation to retry if it fails, based on the type of exception, and with a fixed or exponential backoff.

License:

    Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-retry-1.1.0.RELEASE.jar
MD5: 0958739406306923bde05542a035fb48
SHA1: f7e1ec1fd7c8fcaca490fd298c5b3fe711cb5ed9

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-retry
central | groupid | org.springframework.retry
central | version | 1.1.0.RELEASE
file | name | spring-retry
file | version | 1.1.0
jar | package name | retry
jar | package name | springframework
pom | artifactid | spring-retry
pom | description | Spring Retry provides an abstraction around retrying failed operations, with an emphasis on declarative control of the process and policy-based bahaviour that is easy to extend and customize. For instance, you can configure a plain POJO operation to retry if it fails, based on the type of exception, and with a fixed or exponential backoff.
pom | groupid | springframework.retry
pom | name | Spring Retry
pom | organization name | http://www.springsource.com
pom | url | http://www.springsource.org
pom | version | 1.1.0.RELEASE

#### Identifiers

- maven: org.springframework.retry:spring-retry:1.1.0.RELEASE Confidence:HIGHEST

### spring-security-core-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-security-core-3.0.0.RELEASE.jar
MD5: 740649fa36b65f4bfe7d2a57e2b2807e
SHA1: 23dd919891e86a1b74b9198bd67a4ae9f4849c28

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-security-core
central | groupid | org.springframework.security
central | version | 3.0.0.RELEASE
file | name | spring-security-core
file | version | 3.0.0
hint analyzer | product | springsource_spring_framework
hint analyzer | vendor | SpringSource
hint analyzer | vendor | vmware
Manifest | Bundle-Name | Spring Security Core
Manifest | bundle-symbolicname | org.springframework.security.core
Manifest | Bundle-Version | 3.0.0.RELEASE
pom | artifactid | spring-security-core
pom | groupid | springframework.security
pom | name | Spring Security - Core
pom | parent-artifactid | spring-security-parent
pom | parent-groupid | org.springframework.security
pom | version | 3.0.0.RELEASE

#### Identifiers

- cpe: cpe:/a:vmware:springsource_spring_security:3.0.0 Confidence:HIGHEST
- maven: org.springframework.security:spring-security-core:3.0.0.RELEASE Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2012-5055

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

- CONFIRM - http://support.springsource.com/security/CVE-2012-5055

Vulnerable Software & Versions: (show all)

- cpe:/a:vmware:springsource_spring_security:3.0.0
- ...
- cpe:/a:vmware:springsource_spring_security:2.0.0
- cpe:/a:vmware:springsource_spring_security:2.0.1
- cpe:/a:vmware:springsource_spring_security:2.0.2
- cpe:/a:vmware:springsource_spring_security:2.0.3
- cpe:/a:vmware:springsource_spring_security:2.0.4
- cpe:/a:vmware:springsource_spring_security:2.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.6 and all previous versions
- cpe:/a:vmware:springsource_spring_security:3.0.0
- cpe:/a:vmware:springsource_spring_security:3.0.1
- cpe:/a:vmware:springsource_spring_security:3.0.2
- cpe:/a:vmware:springsource_spring_security:3.0.3
- cpe:/a:vmware:springsource_spring_security:3.0.4
- cpe:/a:vmware:springsource_spring_security:3.0.5
- cpe:/a:vmware:springsource_spring_security:3.1.1
- cpe:/a:vmware:springsource_spring_security:3.1.2

CVE-2011-2894

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

- BID - 49536
- BUGTRAQ - 20110909 CVE-2011-2894: Spring Framework and Spring Security serialization-based remoting vulnerabilities
- CONFIRM - http://www.springsource.com/security/cve-2011-2894
- OSVDB - 75263
- REDHAT - RHSA-2011:1334
- SREASON - 8405
- XF - spring-framework-object-sec-bypass(69687)

Vulnerable Software & Versions: (show all)

- cpe:/a:vmware:springsource_spring_security:3.0.0
- ...
- cpe:/a:vmware:springsource_spring_framework:3.0.0
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m1
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m2
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m3
- cpe:/a:vmware:springsource_spring_framework:3.0.0:m4
- cpe:/a:vmware:springsource_spring_framework:3.0.0:rc1
- cpe:/a:vmware:springsource_spring_framework:3.0.0:rc2
- cpe:/a:vmware:springsource_spring_framework:3.0.0:rc3
- cpe:/a:vmware:springsource_spring_framework:3.0.1
- cpe:/a:vmware:springsource_spring_framework:3.0.2
- cpe:/a:vmware:springsource_spring_framework:3.0.3
- cpe:/a:vmware:springsource_spring_framework:3.0.4
- cpe:/a:vmware:springsource_spring_framework:3.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.0
- cpe:/a:vmware:springsource_spring_security:2.0.1
- cpe:/a:vmware:springsource_spring_security:2.0.2
- cpe:/a:vmware:springsource_spring_security:2.0.3
- cpe:/a:vmware:springsource_spring_security:2.0.4
- cpe:/a:vmware:springsource_spring_security:2.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.6
- cpe:/a:vmware:springsource_spring_security:3.0.0
- cpe:/a:vmware:springsource_spring_security:3.0.1
- cpe:/a:vmware:springsource_spring_security:3.0.2
- cpe:/a:vmware:springsource_spring_security:3.0.3
- cpe:/a:vmware:springsource_spring_security:3.0.4
- cpe:/a:vmware:springsource_spring_security:3.0.5

CVE-2011-2732

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

- CONFIRM - http://support.springsource.com/security/cve-2011-2732
- MISC - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814

Vulnerable Software & Versions: (show all)

- cpe:/a:vmware:springsource_spring_security:3.0.0
- ...
- cpe:/a:vmware:springsource_spring_security:2.0.0
- cpe:/a:vmware:springsource_spring_security:2.0.1
- cpe:/a:vmware:springsource_spring_security:2.0.2
- cpe:/a:vmware:springsource_spring_security:2.0.3
- cpe:/a:vmware:springsource_spring_security:2.0.4
- cpe:/a:vmware:springsource_spring_security:2.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.6 and all previous versions
- cpe:/a:vmware:springsource_spring_security:3.0.0
- cpe:/a:vmware:springsource_spring_security:3.0.1
- cpe:/a:vmware:springsource_spring_security:3.0.2
- cpe:/a:vmware:springsource_spring_security:3.0.3
- cpe:/a:vmware:springsource_spring_security:3.0.4
- cpe:/a:vmware:springsource_spring_security:3.0.5 and all previous versions

CVE-2011-2731

Severity: Medium
CVSS Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

- CONFIRM - http://support.springsource.com/security/cve-2011-2731
- MISC - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
- SECTRACK - 1029151
- SECUNIA - 55155

Vulnerable Software & Versions: (show all)

- cpe:/a:vmware:springsource_spring_security:3.0.0
- ...
- cpe:/a:vmware:springsource_spring_security:2.0.0
- cpe:/a:vmware:springsource_spring_security:2.0.1
- cpe:/a:vmware:springsource_spring_security:2.0.2
- cpe:/a:vmware:springsource_spring_security:2.0.3
- cpe:/a:vmware:springsource_spring_security:2.0.4
- cpe:/a:vmware:springsource_spring_security:2.0.5
- cpe:/a:vmware:springsource_spring_security:2.0.6 and all previous versions
- cpe:/a:vmware:springsource_spring_security:3.0.0
- cpe:/a:vmware:springsource_spring_security:3.0.1
- cpe:/a:vmware:springsource_spring_security:3.0.2
- cpe:/a:vmware:springsource_spring_security:3.0.3
- cpe:/a:vmware:springsource_spring_security:3.0.4
- cpe:/a:vmware:springsource_spring_security:3.0.5 and all previous versions

CVE-2010-3700

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

- BID - 44496
- BUGTRAQ - 20101027 CVE-2010-3700: Spring Security bypass of security constraints
- CONFIRM - http://www.springsource.com/security/cve-2010-3700
- MISC - https://issues.apache.org/bugzilla/show_bug.cgi?id=25015
- OSVDB - 68931
- SECUNIA - 42024

Vulnerable Software & Versions: (show all)

- cpe:/a:vmware:springsource_spring_security:3.0.0
- ...
- cpe:/a:acegisecurity:acegi-security:1.0.0
- cpe:/a:acegisecurity:acegi-security:1.0.1
- cpe:/a:acegisecurity:acegi-security:1.0.2
- cpe:/a:acegisecurity:acegi-security:1.0.3
- cpe:/a:acegisecurity:acegi-security:1.0.4
- cpe:/a:acegisecurity:acegi-security:1.0.5
- cpe:/a:acegisecurity:acegi-security:1.0.6
- cpe:/a:acegisecurity:acegi-security:1.0.7
- cpe:/a:ibm:websphere_application_server:6.1
- cpe:/a:ibm:websphere_application_server:7.0
- cpe:/a:vmware:springsource_spring_security:2.0.0
- cpe:/a:vmware:springsource_spring_security:2.0.1
- cpe:/a:vmware:springsource_spring_security:2.0.2
- cpe:/a:vmware:springsource_spring_security:2.0.3
- cpe:/a:vmware:springsource_spring_security:2.0.4
- cpe:/a:vmware:springsource_spring_security:2.0.5
- cpe:/a:vmware:springsource_spring_security:3.0.0
- cpe:/a:vmware:springsource_spring_security:3.0.1
- cpe:/a:vmware:springsource_spring_security:3.0.2
- cpe:/a:vmware:springsource_spring_security:3.0.3

### spring-security-web-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-security-web-3.0.0.RELEASE.jar
MD5: 0a37a920e2dfa3ce8d502fb8922d117c
SHA1: ec46f545b5abd27c38588a1ae7e8eab1472f2261

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-security-web
central | groupid | org.springframework.security
central | version | 3.0.0.RELEASE
file | name | spring-security-web
file | version | 3.0.0
Manifest | Bundle-Name | Spring Security Web
Manifest | bundle-symbolicname | org.springframework.security.web
Manifest | Bundle-Version | 3.0.0.RELEASE
pom | artifactid | spring-security-web
pom | groupid | springframework.security
pom | name | Spring Security - Web Application Security Module
pom | parent-artifactid | spring-security-parent
pom | parent-groupid | org.springframework.security
pom | version | 3.0.0.RELEASE

#### Identifiers

- maven: org.springframework.security:spring-security-web:3.0.0.RELEASE Confidence:HIGHEST

### spring-tx-3.0.0.RELEASE.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\spring-tx-3.0.0.RELEASE.jar
MD5: 09b7bed15d5c5c50faaa29f17b639271
SHA1: 8d5a9940ad1687e8d6fc13eed11203619b47e248

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | spring-tx
central | groupid | org.springframework
central | version | 3.0.0.RELEASE
file | name | spring-tx
file | version | 3.0.0
jar | package name | springframework
Manifest | Bundle-Name | Spring Transaction
Manifest | bundle-symbolicname | org.springframework.transaction
Manifest | Bundle-Version | 3.0.0.RELEASE
Manifest | ignored-existing-headers | Bnd-LastModified,Import-Package,Export-Package,Tool
Manifest | Implementation-Title | org.springframework.transaction
Manifest | Implementation-Version | 3.0.0.RELEASE
Manifest | import-template | com.ibm.wsspi.uow.*;version="[6.0.2.17, 6.1.0)";resolution:=optional,javax.ejb.*;version="[3.0.0, 4.0.0)";resolution:=optional,javax.management.*;version="0";resolution:=optional,javax.naming.*;version="0";resolution:=optional,javax.resource.*;version="[1.5.0, 2.0.0)";resolution:=optional,javax.transaction.*;version="[1.0.1, 2.0.0)";resolution:=optional,org.aopalliance.*;version="[1.0.0, 2.0.0)";resolution:=optional,org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",org.springframework.aop.*;version="[3.0.0, 3.0.1)";resolution:=optional,org.springframework.beans.*;version="[3.0.0, 3.0.1)",org.springframework.context.*;version="[3.0.0, 3.0.1)";resolution:=optional,org.springframework.core.*;version="[3.0.0, 3.0.1)",org.springframework.jndi.*;version="[3.0.0, 3.0.1)";resolution:=optional,org.springframework.scheduling.*;version="[3.0.0, 3.0.1)";resolution:=optional,org.springframework.stereotype;version="[3.0.0, 3.0.1)";resolution:=optional,org.springframework.util.*;version="[3.0.0, 3.0.1)",org.w3c.dom.*;version="0";resolution:=optional
pom | artifactid | spring-tx
pom | groupid | springframework
pom | parent-artifactid | spring-parent
pom | parent-groupid | org.springframework
pom | version | 3.0.0.RELEASE

#### Identifiers

- maven: org.springframework:spring-tx:3.0.0.RELEASE Confidence:HIGHEST

### stagedhttp-modified.tar: commons-httpclient-2.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\commons-httpclient-2.0.jar
MD5: e0c0c1f887a8b1025a8bed9bff6ab771
SHA1: 19f1cb5ffd50c37b7ee43b8bc7a185b421ea3e9c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-httpclient
central | groupid | commons-httpclient
central | version | 2.0
file | name | commons-httpclient
file | version | 2.0
jar | package name | apache
jar | package name | commons
jar | package name | httpclient
Manifest | extension-name | commons-httpclient
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id |
Manifest | Implementation-Version | 2.0
Manifest | specification-title | Jakarta Commons HttpClient
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | commons-httpclient
pom | groupid | commons-httpclient
pom | version | 2.0

#### Identifiers

- maven: commons-httpclient:commons-httpclient:2.0 Confidence:HIGHEST
- cpe: cpe:/a:apache:commons-httpclient:2.0 Confidence:LOW
- cpe: cpe:/a:apache:httpclient:2.0 Confidence:LOW

#### Published Vulnerabilities

CVE-2015-5262

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1626784
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1261538
- CONFIRM - https://issues.apache.org/jira/browse/HTTPCLIENT-1478
- FEDORA - FEDORA-2015-15588
- FEDORA - FEDORA-2015-15589
- FEDORA - FEDORA-2015-15590
- SECTRACK - 1033743
- UBUNTU - USN-2769-1

Vulnerable Software & Versions:

- cpe:/a:apache:httpclient:4.3.5 and all previous versions

CVE-2014-3577

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

- CONFIRM - https://access.redhat.com/solutions/1165533
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
- FULLDISC - 20140818 CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack
- MISC - http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html
- REDHAT - RHSA-2014:1146
- REDHAT - RHSA-2014:1166
- REDHAT - RHSA-2014:1833
- REDHAT - RHSA-2014:1834
- REDHAT - RHSA-2014:1835
- REDHAT - RHSA-2014:1836
- REDHAT - RHSA-2014:1891
- REDHAT - RHSA-2014:1892
- REDHAT - RHSA-2015:0125
- REDHAT - RHSA-2015:0158
- REDHAT - RHSA-2015:0675
- REDHAT - RHSA-2015:0720
- REDHAT - RHSA-2015:0765
- REDHAT - RHSA-2015:0850
- REDHAT - RHSA-2015:0851
- REDHAT - RHSA-2015:1176
- REDHAT - RHSA-2015:1177
- UBUNTU - USN-2769-1

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:httpclient:4.3.4 and all previous versions
- ...
- cpe:/a:apache:httpasyncclient:4.0
- cpe:/a:apache:httpasyncclient:4.0:alpha1
- cpe:/a:apache:httpasyncclient:4.0:alpha2
- cpe:/a:apache:httpasyncclient:4.0:alpha3
- cpe:/a:apache:httpasyncclient:4.0:beta1
- cpe:/a:apache:httpasyncclient:4.0:beta2
- cpe:/a:apache:httpasyncclient:4.0:beta3
- cpe:/a:apache:httpasyncclient:4.0:beta4
- cpe:/a:apache:httpasyncclient:4.0.1 and all previous versions
- cpe:/a:apache:httpclient:4.0
- cpe:/a:apache:httpclient:4.0:alpha1
- cpe:/a:apache:httpclient:4.0:alpha2
- cpe:/a:apache:httpclient:4.0:alpha3
- cpe:/a:apache:httpclient:4.0:alpha4
- cpe:/a:apache:httpclient:4.0:beta1
- cpe:/a:apache:httpclient:4.0:beta2
- cpe:/a:apache:httpclient:4.0.1
- cpe:/a:apache:httpclient:4.1
- cpe:/a:apache:httpclient:4.1:alpha1
- cpe:/a:apache:httpclient:4.1:alpha2
- cpe:/a:apache:httpclient:4.1:beta1
- cpe:/a:apache:httpclient:4.1.1
- cpe:/a:apache:httpclient:4.1.2
- cpe:/a:apache:httpclient:4.2
- cpe:/a:apache:httpclient:4.2:alpha1
- cpe:/a:apache:httpclient:4.2:beta1
- cpe:/a:apache:httpclient:4.2.1
- cpe:/a:apache:httpclient:4.2.2
- cpe:/a:apache:httpclient:4.2.3
- cpe:/a:apache:httpclient:4.3
- cpe:/a:apache:httpclient:4.3:alpha1
- cpe:/a:apache:httpclient:4.3:beta1
- cpe:/a:apache:httpclient:4.3:beta2
- cpe:/a:apache:httpclient:4.3.1
- cpe:/a:apache:httpclient:4.3.2
- cpe:/a:apache:httpclient:4.3.3
- cpe:/a:apache:httpclient:4.3.4 and all previous versions

### stagedhttp-modified.tar: commons-logging.jar

Description: Commons Logging

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\commons-logging.jar
MD5: 5bc8bdd15b18018e84fd862993aaca42
SHA1: 760c711c71588bc273d3e56d196d720a7678cd93

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-logging
central | groupid | commons-logging
central | version | 1.0.3
file | name | commons-logging
jar | package name | apache
jar | package name | commons
jar | package name | impl
jar | package name | logging
Manifest | extension-name | org.apache.commons.logging
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Version | 1.0.3
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | commons-logging
pom | description | Commons Logging
pom | groupid | commons-logging
pom | name | Logging
pom | url | http://jakarta.apache.org/commons/logging/
pom | version | 1.0.3

#### Identifiers

- maven: commons-logging:commons-logging:1.0.3 Confidence:HIGHEST

### stagedhttp-modified.tar: dom4j.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\dom4j.jar
MD5: 85e3e7dfd9d039da0b8ea0a46129323f
SHA1: 8decb7e2c04c9340375aaf7dd43a7a6a9b9a46b1

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | dom4j
central | groupid | dom4j
central | version | 1.4
file | name | dom4j
file | version | 4
Manifest | extension-name | org.dom4j
Manifest | Implementation-Title | dom4j
Manifest | Implementation-Vendor | MetaStuff Ltd.
Manifest | Implementation-Version | 1.3
Manifest | specification-title | dom4j
Manifest | specification-vendor | MetaStuff Ltd.
pom | artifactid | dom4j
pom | groupid | dom4j
pom | version | 1.4

#### Identifiers

- maven: dom4j:dom4j:1.4 Confidence:HIGHEST

### stagedhttp-modified.tar: jgroups-all.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\jgroups-all.jar
MD5: 06b44a40f4215af9a534ace65c51a2ca
SHA1: 15201a98948972d4e890a1d9bd6b728b917ef21c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | jgroups-all
central | groupid | jgroups
central | version | 2.2.7
file | name | jgroups-all
jar | package name | jgroups
pom | artifactid | jgroups-all
pom | groupid | jgroups
pom | version | 2.2.7

#### Identifiers

- maven: jgroups:jgroups-all:2.2.7 Confidence:HIGHEST

### stagedhttp-modified.tar: log4j.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\log4j.jar
MD5: 91e6a0cd2788d69808c05fae11d69679
SHA1: c28b336aa1547a885ddef944af6bfb7bff25abf0

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | log4j
file | version | 4
jar | package name | apache
jar | package name | log4j
manifest: org/apache/log4j/ | Implementation-Title | log4j
manifest: org/apache/log4j/ | Implementation-Vendor | "Apache Software Foundation"
manifest: org/apache/log4j/ | Implementation-Version | 1.2

#### Identifiers

- None

### stagedhttp-modified.tar: mail.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\mail.jar
MD5: 3ad3cde613b7e9700fed08d979bcccc7
SHA1: 6d16579c99ea9fd5ca5fd2dbe45a5144c2873681

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | mail
jar | package name | mail
jar | package name | sun
jar (hint) | package name | oracle
Manifest | extension-name | javax.mail
Manifest | Implementation-Vendor | Sun Microsystems, Inc.
Manifest | Implementation-Vendor-Id | com.sun
Manifest | Implementation-Version | 1.3.2
Manifest | sccs-id | @(#)javamail.mf 1.5 02/03/14
Manifest | specification-title | JavaMail(TM) API Design Specification
Manifest | specification-vendor | Sun Microsystems, Inc.

#### Identifiers

- cpe: cpe:/a:sun:javamail:1.3.2 Confidence:HIGH

#### Published Vulnerabilities

CVE-2007-6059

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products."

- BUGTRAQ - 20071116 Javamail login username and password same email problem
- OSVDB - 45299

Vulnerable Software & Versions:

- cpe:/a:sun:javamail

CVE-2005-1754

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

** DISPUTED ** JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."

- BID - 13753
- BUGTRAQ - 20050524 Javamail Multiple Information Disclosure Vulnerabilities
- MISC - http://tomcat.apache.org/security-5.html

Vulnerable Software & Versions: (show all)

- cpe:/a:sun:javamail:1.3.2
- ...
- cpe:/a:apache_tomcat:apache_tomcat:5.0.16
- cpe:/a:sun:javamail:1.1.3
- cpe:/a:sun:javamail:1.2
- cpe:/a:sun:javamail:1.3
- cpe:/a:sun:javamail:1.3.2

CVE-2005-1105

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the Content-Disposition header.

- BUGTRAQ - 20050412 JavaMail allows directory traversal in attachments

Vulnerable Software & Versions:

- cpe:/a:sun:javamail:1.3.2

### stagedhttp-modified.tar: serializer.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\serializer.jar
MD5: 35aa6a56662458d9dc28a9b628f84847
SHA1: 85ddd38e4cdbc22fb6c518f3d35744336da6fbfd

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | serializer
jar | package name | apache
jar | package name | serializer
jar | package name | xml
manifest: org/apache/xml/serializer/ | Implementation-Title | org.apache.xml.serializer
manifest: org/apache/xml/serializer/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xml/serializer/ | Implementation-Version | 2.7.0
manifest: org/apache/xml/serializer/ | Specification-Title | XSL Transformations (XSLT), at http://www.w3.org/TR/xslt
manifest: org/apache/xml/serializer/utils/ | Implementation-Title | org.apache.xml.serializer.utils
manifest: org/apache/xml/serializer/utils/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xml/serializer/utils/ | Implementation-Version | 2.7.0

#### Identifiers

- None

### stagedhttp-modified.tar: xalan.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\xalan.jar
MD5: 126c0c876a6b9726cfdd43f052923660
SHA1: 10f170da8dfbcdcc4098131ba773710f0ba7aef1

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | xalan
jar | package name | apache
manifest: java_cup/runtime/ | Implementation-Title | runtime
manifest: java_cup/runtime/ | Implementation-Vendor | Princeton University
manifest: java_cup/runtime/ | Implementation-Version | 2.7.0
manifest: java_cup/runtime/ | Specification-Title | Runtime component of JCup
manifest: org/apache/bcel/ | Implementation-Title | org.apache.bcel
manifest: org/apache/bcel/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/bcel/ | Implementation-Version | 2.7.0
manifest: org/apache/bcel/ | Specification-Title | Byte Code Engineering Library
manifest: org/apache/regexp/ | Implementation-Title | org.apache.regexp
manifest: org/apache/regexp/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/regexp/ | Implementation-Version | 2.7.0
manifest: org/apache/regexp/ | Specification-Title | Java Regular Expression package
manifest: org/apache/xalan/ | Implementation-Title | org.apache.xalan
manifest: org/apache/xalan/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xalan/ | Implementation-Version | 2.7.0
manifest: org/apache/xalan/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xalan/xsltc/ | Implementation-Title | org.apache.xalan.xsltc
manifest: org/apache/xalan/xsltc/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xalan/xsltc/ | Implementation-Version | 2.7.0
manifest: org/apache/xalan/xsltc/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xml/ | Implementation-Title | org.apache.xml
manifest: org/apache/xml/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xml/ | Implementation-Version | 2.7.0
manifest: org/apache/xpath/ | Implementation-Title | org.apache.xpath
manifest: org/apache/xpath/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xpath/ | Implementation-Version | 2.7.0

#### Identifiers

- cpe: cpe:/a:apache:xalan-java:2.7.0 Confidence:MEDIUM

#### Published Vulnerabilities

CVE-2014-0107

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

- BID - 66397
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1581058
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677145
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680703
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681933
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- CONFIRM - https://issues.apache.org/jira/browse/XALANJ-2435
- GENTOO - GLSA-201604-02
- MISC - http://www.ocert.org/advisories/ocert-2014-002.html
- REDHAT - RHSA-2014:1351
- XF - apache-xalanjava-cve20140107-sec-bypass(92023)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:xalan-java:2.7.0
- ...
- cpe:/a:apache:xalan-java:1.0.0
- cpe:/a:apache:xalan-java:2.0.0
- cpe:/a:apache:xalan-java:2.0.1
- cpe:/a:apache:xalan-java:2.1.0
- cpe:/a:apache:xalan-java:2.2.0
- cpe:/a:apache:xalan-java:2.4.0
- cpe:/a:apache:xalan-java:2.4.1
- cpe:/a:apache:xalan-java:2.5.0
- cpe:/a:apache:xalan-java:2.5.1
- cpe:/a:apache:xalan-java:2.5.2
- cpe:/a:apache:xalan-java:2.6.0
- cpe:/a:apache:xalan-java:2.7.0
- cpe:/a:apache:xalan-java:2.7.1 and all previous versions
- cpe:/a:oracle:webcenter_sites:7.6.2
- cpe:/a:oracle:webcenter_sites:11.1.1.8.0

### stagedhttp-modified.tar: xmlsec-1.3.0.jar

Description: The XML Security project is aimed at providing implementation of security standards for XML

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\xmlsec-1.3.0.jar
MD5: ed82e8662f1823e70ba8f468f57eb11b
SHA1: 59c4b71e0a5871f26db91eaab236e5b9bf41122e

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xmlsec
central | groupid | org.codehaus.xfire
central | groupid | xml-security
central | version | 1.3.0
file | name | xmlsec
file | version | 1.3.0
jar | package name | apache
jar | package name | security
jar | package name | xml
manifest: xmlsec | Implementation-Title | Apache-XML-Security-J
manifest: xmlsec | Implementation-Vendor | Apache Software Foundation
manifest: xmlsec | Implementation-Version | 1.3.0 ${TODAY}
pom | artifactid | xmlsec
pom | description | The XML Security project is aimed at providing implementation of security standards for XML
pom | groupid | xml-security
pom | name | Apache XML Security
pom | parent-artifactid | apache
pom | parent-groupid | org.apache
pom | parent-version | 1.3.0
pom | url | http://santuario.apache.org/
pom | version | 1.3.0

#### Identifiers

- maven: org.codehaus.xfire:xmlsec:1.3.0 Confidence:HIGHEST
- maven: xml-security:xmlsec:1.3.0 Confidence:HIGHEST

### stagedhttp-modified.tar: xss4j.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\xss4j.jar
MD5: 3572ac321c3a854ec49d8594a17e3699
SHA1: d0f4126b39370c3fad93163ca17fd3caa3d29e97

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | xss4j
file | version | 4
jar | package name | ibm
jar | package name | xml

#### Identifiers

- None

### struts.jar

Description: The core of the Struts framework is a flexible control layer based on standard technologies like Java Servlets, JavaBeans, ResourceBundles, and Extensible Markup Language (XML), as well as various Jakarta Commons packages. Struts encourages application architectures based on the Model 2 approach, a variation of the classic Model-View-Controller (MVC) design paradigm. Struts provides its own Controller component and integrates with other technologies to provide the Model and the View. For the Model, Struts can interact with any standard data access technology, including Enterprise Java Beans, JDBC, and Object Relational Bridge. For the View, Struts works well with JavaServer Pages, including JSTL and JSF, as well as Velocity Templates, XSLT, and other presentation systems. The Struts framework provides the invisible underpinnings every professional web application needs to survive. Struts helps you create an extensible development environment for your application, based on published standards and proven design patterns.

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\struts.jar
MD5: aa4ae098ec87fbcd6591402e5cbd781a
SHA1: f69e6119eb01f9ad064bd358ed0315618fb1cb5c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | struts
central | groupid | struts
central | version | 1.2.7
file | name | struts
jar | package name | apache
jar | package name | struts
Manifest | extension-name | Struts Framework
Manifest | Implementation-Title | Struts Framework
Manifest | Implementation-Vendor | The Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.2.7
Manifest | specification-title | Struts Framework
Manifest | specification-vendor | The Apache Software Foundation
pom | artifactid | struts
pom | description | The core of the Struts framework is a flexible control layer based on standard technologies like Java Servlets, JavaBeans, ResourceBundles, and Extensible Markup Language (XML), as well as various Jakarta Commons packages. Struts encourages application architectures based on the Model 2 approach, a variation of the classic Model-View-Controller (MVC) design paradigm. Struts provides its own Controller component and integrates with other technologies to provide the Model and the View. For the Model, Struts can interact with any standard data access technology, including Enterprise Java Beans, JDBC, and Object Relational Bridge. For the View, Struts works well with JavaServer Pages, including JSTL and JSF, as well as Velocity Templates, XSLT, and other presentation systems. The Struts framework provides the invisible underpinnings every professional web application needs to survive. Struts helps you create an extensible development environment for your application, based on published standards and proven design patterns.
pom | groupid | struts
pom | name | Struts
pom | organization name | http://www.apache.org/
pom | url | http://struts.apache.org/index.html
pom | version | 1.2.7

#### Identifiers

- cpe: cpe:/a:apache:struts:1.2.7 Confidence:HIGHEST
- maven: struts:struts:1.2.7 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2016-1182

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-20 Improper Input Validation

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1343540
- CONFIRM - https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8
- CONFIRM - https://security-tracker.debian.org/tracker/CVE-2016-1182
- JVN - JVN#65044642
- JVNDB - JVNDB-2016-000097

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:1.2.7
- ...
- cpe:/a:apache:struts:1.0
- cpe:/a:apache:struts:1.0.2
- cpe:/a:apache:struts:1.1
- cpe:/a:apache:struts:1.1:b1
- cpe:/a:apache:struts:1.1:b2
- cpe:/a:apache:struts:1.1:b3
- cpe:/a:apache:struts:1.1:rc1
- cpe:/a:apache:struts:1.1:rc2
- cpe:/a:apache:struts:1.2.2
- cpe:/a:apache:struts:1.2.4
- cpe:/a:apache:struts:1.2.6
- cpe:/a:apache:struts:1.2.7
- cpe:/a:apache:struts:1.2.8
- cpe:/a:apache:struts:1.2.9
- cpe:/a:apache:struts:1.3.5
- cpe:/a:apache:struts:1.3.8
- cpe:/a:apache:struts:1.3.10

CVE-2016-1181

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1343538
- CONFIRM - https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8
- CONFIRM - https://security-tracker.debian.org/tracker/CVE-2016-1181
- JVN - JVN#03188560
- JVNDB - JVNDB-2016-000096

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:1.2.7
- ...
- cpe:/a:apache:struts:1.0
- cpe:/a:apache:struts:1.0.2
- cpe:/a:apache:struts:1.1
- cpe:/a:apache:struts:1.1:b1
- cpe:/a:apache:struts:1.1:b2
- cpe:/a:apache:struts:1.1:b3
- cpe:/a:apache:struts:1.1:rc1
- cpe:/a:apache:struts:1.1:rc2
- cpe:/a:apache:struts:1.2.2
- cpe:/a:apache:struts:1.2.4
- cpe:/a:apache:struts:1.2.6
- cpe:/a:apache:struts:1.2.7
- cpe:/a:apache:struts:1.2.8
- cpe:/a:apache:struts:1.2.9
- cpe:/a:apache:struts:1.3.5
- cpe:/a:apache:struts:1.3.8
- cpe:/a:apache:struts:1.3.10
- cpe:/a:oracle:banking_platform:2.3.0
- cpe:/a:oracle:banking_platform:2.4.0
- cpe:/a:oracle:banking_platform:2.4.1
- cpe:/a:oracle:banking_platform:2.5.0
- cpe:/a:oracle:portal:11.1.1.6

CVE-2015-0899

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

- CONFIRM - https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN
- JVN - JVN#86448949
- JVNDB - JVNDB-2015-000042

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:1.2.7
- ...
- cpe:/a:apache:struts:1.0
- cpe:/a:apache:struts:1.0.2
- cpe:/a:apache:struts:1.1
- cpe:/a:apache:struts:1.1:b1
- cpe:/a:apache:struts:1.1:b2
- cpe:/a:apache:struts:1.1:b3
- cpe:/a:apache:struts:1.1:rc1
- cpe:/a:apache:struts:1.1:rc2
- cpe:/a:apache:struts:1.2.2
- cpe:/a:apache:struts:1.2.4
- cpe:/a:apache:struts:1.2.6
- cpe:/a:apache:struts:1.2.7
- cpe:/a:apache:struts:1.2.8
- cpe:/a:apache:struts:1.2.9
- cpe:/a:apache:struts:1.3.5
- cpe:/a:apache:struts:1.3.8
- cpe:/a:apache:struts:1.3.10

CVE-2014-0114

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

- BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- CONFIRM - http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676091
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676303
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676375
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676931
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- CONFIRM - https://access.redhat.com/solutions/869353
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1091938
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1116665
- CONFIRM - https://issues.apache.org/jira/browse/BEANUTILS-463
- DEBIAN - DSA-2940
- FEDORA - FEDORA-2014-9380
- FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- HP - HPSBGN03041
- HP - HPSBMU03090
- HP - HPSBST03160
- MLIST - [oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE
- MLIST - [oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:1.2.7
- ...
- cpe:/a:apache:commons_beanutils:1.9.1 and all previous versions
- cpe:/a:apache:struts:1.0
- cpe:/a:apache:struts:1.0.2
- cpe:/a:apache:struts:1.1
- cpe:/a:apache:struts:1.1:b1
- cpe:/a:apache:struts:1.1:b2
- cpe:/a:apache:struts:1.1:b3
- cpe:/a:apache:struts:1.1:rc1
- cpe:/a:apache:struts:1.1:rc2
- cpe:/a:apache:struts:1.2.2
- cpe:/a:apache:struts:1.2.4
- cpe:/a:apache:struts:1.2.6
- cpe:/a:apache:struts:1.2.7
- cpe:/a:apache:struts:1.2.8
- cpe:/a:apache:struts:1.2.9
- cpe:/a:apache:struts:1.3.5
- cpe:/a:apache:struts:1.3.8
- cpe:/a:apache:struts:1.3.10

CVE-2008-6504

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.

- BID - 32101
- CONFIRM - http://fisheye6.atlassian.com/cru/CR-9/
- CONFIRM - http://issues.apache.org/struts/browse/WW-2692
- CONFIRM - http://jira.opensymphony.com/browse/XW-641
- CONFIRM - http://struts.apache.org/2.x/docs/s2-003.html
- OSVDB - 49732
- SECUNIA - 32495
- SECUNIA - 32497
- VUPEN - ADV-2008-3003
- VUPEN - ADV-2008-3004
- XF - xwork-parameterinterceptor-security-bypass(46328)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts
- ...
- cpe:/a:apache:struts
- cpe:/a:opensymphony:xwork:2.0.0
- cpe:/a:opensymphony:xwork:2.0.1
- cpe:/a:opensymphony:xwork:2.0.2
- cpe:/a:opensymphony:xwork:2.0.3
- cpe:/a:opensymphony:xwork:2.0.4
- cpe:/a:opensymphony:xwork:2.0.5
- cpe:/a:opensymphony:xwork:2.1.0
- cpe:/a:opensymphony:xwork:2.1.1

CVE-2008-2025

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."

- CONFIRM - http://download.opensuse.org/update/10.3-test/repodata/patch-struts-5872.xml
- CONFIRM - http://support.novell.com/security/cve/CVE-2008-2025.html
- MISC - https://bugzilla.novell.com/show_bug.cgi?id=385273
- MISC - https://launchpad.net/bugs/cve/2008-2025
- OSVDB - 53380
- SECUNIA - 34567
- SECUNIA - 34642
- SUSE - SUSE-SR:2009:008

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:1.2.7
- ...
- cpe:/a:apache:struts:1.0.2
- cpe:/a:apache:struts:1.1
- cpe:/a:apache:struts:1.2.4
- cpe:/a:apache:struts:1.2.7
- cpe:/a:apache:struts:1.2.8

CVE-2006-1548

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

- BID - 17342
- CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=38749
- CONFIRM - http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
- CONFIRM - https://issues.apache.org/struts/browse/STR-2781
- SECTRACK - 1015856
- SECUNIA - 19493
- SECUNIA - 20117
- SUSE - SUSE-SR:2006:010
- VUPEN - ADV-2006-1205
- XF - struts-lookupmap-xss(25614)

Vulnerable Software & Versions:

- cpe:/a:apache:struts:1.2.8 and all previous versions

CVE-2006-1547

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

- BID - 17342
- CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
- CONFIRM - http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
- SECTRACK - 1015856
- SECUNIA - 19493
- SECUNIA - 20117
- SUSE - SUSE-SR:2006:010
- VUPEN - ADV-2006-1205
- XF - struts-actionform-dos(25613)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:1.2.7
- ...
- cpe:/a:apache:struts:1.2.7
- cpe:/a:apache:struts:1.2.8 and all previous versions

CVE-2006-1546

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

- BID - 17342
- CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=38374
- CONFIRM - http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
- MLIST - [struts-devel] 20060122 Re: Validation Security Hole?
- MLIST - [struts-user] 20060121 Validation Security Hole?
- SECTRACK - 1015856
- SECUNIA - 19493
- SECUNIA - 20117
- SUSE - SUSE-SR:2006:010
- VUPEN - ADV-2006-1205
- XF - struts-iscancelled-security-bypass(25612)

Vulnerable Software & Versions:

- cpe:/a:apache:struts:1.2.8 and all previous versions

CVE-2005-3745

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.

- BID - 15512
- BUGTRAQ - 20051121 Security Advisory: Struts Error Message Cross Site Scripting
- MISC - http://www.hacktics.com/AdvStrutsNov05.html
- OSVDB - 21021
- REDHAT - RHSA-2006:0157
- REDHAT - RHSA-2006:0161
- SECTRACK - 1015257
- SECUNIA - 17677
- SECUNIA - 18341
- SREASON - 197
- VUPEN - ADV-2005-2525

Vulnerable Software & Versions:

- cpe:/a:apache:struts:1.2.7

### struts2-core-2.1.2.jar

Description: Apache Struts 2

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\struts2-core-2.1.2.jar
MD5: c30b57142e1ccbc1efd5cd15f307358f
SHA1: 89ce9e36aa9a9e03f1450936d2f4f8dd0f961f8b

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | struts2-core
central | groupid | org.apache.struts
central | version | 2.1.2
file | name | struts2-core
file | version | 2.1.2
manifest | Bundle-Description | Apache Struts 2
Manifest | bundle-docurl | http://www.apache.org
Manifest | Bundle-Name | Struts 2 Core
Manifest | bundle-symbolicname | org.apache.struts.struts2-core
Manifest | Bundle-Version | 2.1.2
pom | artifactid | struts2-core
pom | groupid | apache.struts
pom | name | Struts 2 Core
pom | parent-artifactid | struts2-parent
pom | parent-groupid | org.apache.struts
pom | version | 2.1.2

#### Identifiers

- cpe: cpe:/a:apache:struts:2.1.2 Confidence:HIGHEST
- maven: org.apache.struts:struts2-core:2.1.2 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2016-4003

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

- CONFIRM - http://struts.apache.org/docs/s2-028.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-4507
- SECTRACK - 1035268

Vulnerable Software & Versions:

- cpe:/a:apache:struts:2.3.24.1 and all previous versions

CVE-2016-3093

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

- CONFIRM - http://struts.apache.org/docs/s2-034.html
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21987854
- SECTRACK - 1036018

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1
- cpe:/a:apache:struts:2.3.16.2
- cpe:/a:apache:struts:2.3.16.3
- cpe:/a:apache:struts:2.3.20
- cpe:/a:apache:struts:2.3.20.1
- cpe:/a:apache:struts:2.3.20.3
- cpe:/a:apache:struts:2.3.24
- cpe:/a:apache:struts:2.3.24.1
- cpe:/a:ognl_project:ognl:3.0.11 and all previous versions

CVE-2016-3082

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-20 Improper Input Validation

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

- CONFIRM - http://struts.apache.org/docs/s2-031.html
- SECTRACK - 1035664

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1
- cpe:/a:apache:struts:2.3.16.2
- cpe:/a:apache:struts:2.3.16.3
- cpe:/a:apache:struts:2.3.20
- cpe:/a:apache:struts:2.3.20.1
- cpe:/a:apache:struts:2.3.24
- cpe:/a:apache:struts:2.3.24.1
- cpe:/a:apache:struts:2.3.28

CVE-2016-3081

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

- BID - 91787
- CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- CONFIRM - https://struts.apache.org/docs/s2-032.html
- MISC - http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
- MISC - http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- SECTRACK - 1035665

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1
- cpe:/a:apache:struts:2.3.16.2
- cpe:/a:apache:struts:2.3.16.3
- cpe:/a:apache:struts:2.3.20
- cpe:/a:apache:struts:2.3.20.1
- cpe:/a:apache:struts:2.3.24
- cpe:/a:apache:struts:2.3.24.1
- cpe:/a:apache:struts:2.3.28

CVE-2016-2162

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

- CONFIRM - http://struts.apache.org/docs/s2-030.html
- SECTRACK - 1035272

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.2_beta
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1
- cpe:/a:apache:struts:2.3.16.2
- cpe:/a:apache:struts:2.3.16.3
- cpe:/a:apache:struts:2.3.20
- cpe:/a:apache:struts:2.3.24
- cpe:/a:apache:struts:2.3.24.1

CVE-2016-0785

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-20 Improper Input Validation

Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.

- CONFIRM - http://struts.apache.org/docs/s2-029.html
- SECTRACK - 1035271

Vulnerable Software & Versions:

- cpe:/a:apache:struts:2.3.24.1 and all previous versions

CVE-2014-7809

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-352

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.

- BID - 71548
- BUGTRAQ - 20141208 [ANN] Apache Struts 2.3.20 GA release available with security fix
- CONFIRM - http://struts.apache.org/docs/s2-023.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- MISC - http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html
- SECTRACK - 1031309

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1
- cpe:/a:apache:struts:2.3.16.2
- cpe:/a:apache:struts:2.3.16.3

CVE-2014-0116

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

CookieInterceptor in Apache Struts 2.x before 2.3.16.3, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

- BID - 67218
- CONFIRM - http://struts.apache.org/release/2.3.x/docs/s2-022.html
- CONFIRM - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1
- cpe:/a:apache:struts:2.3.16.2

CVE-2014-0113

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

- BUGTRAQ - 20140426 [ANN] Struts 2.3.16.2 GA release available - security fix
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- CONFIRM - https://cwiki.apache.org/confluence/display/WW/S2-021

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1 and all previous versions

CVE-2014-0112

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

- BUGTRAQ - 20140426 [ANN] Struts 2.3.16.2 GA release available - security fix
- BUGTRAQ - 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1091939
- CONFIRM - https://cwiki.apache.org/confluence/display/WW/S2-021
- JVN - JVN#19294237
- JVNDB - JVNDB-2014-000045
- MISC - http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16
- cpe:/a:apache:struts:2.3.16.1 and all previous versions

CVE-2014-0094

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

- BID - 65999
- BUGTRAQ - 20140306 [ANN] Struts 2.3.16.1 GA release available - security fix
- BUGTRAQ - 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library
- CONFIRM - http://struts.apache.org/release/2.3.x/docs/s2-020.html
- CONFIRM - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
- CONFIRM - http://www.konakart.com/downloads/ver-7-3-0-0-whats-new
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- JVN - JVN#19294237
- JVNDB - JVNDB-2014-000045
- MISC - http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- SECTRACK - 1029876

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1
- cpe:/a:apache:struts:2.3.15.2
- cpe:/a:apache:struts:2.3.15.3
- cpe:/a:apache:struts:2.3.16 and all previous versions

CVE-2013-4316

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-16 Configuration

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

- BID - 64758
- BUGTRAQ - 20130921 [ANN] Struts 2.3.15.2 GA release available - security fix
- CONFIRM - http://struts.apache.org/release/2.3.x/docs/s2-019.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- SECTRACK - 1029078

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1

CVE-2013-4310

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

- BID - 64758
- BUGTRAQ - 20130921 [ANN] Struts 2.3.15.2 GA release available - security fix
- BUGTRAQ - 20131017 [ANN] Struts 2.3.15.3 GA release available - security fix
- CONFIRM - http://struts.apache.org/release/2.3.x/docs/s2-018.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- SECTRACK - 1029077
- SECUNIA - 54919
- SECUNIA - 56483
- SECUNIA - 56492

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15
- cpe:/a:apache:struts:2.3.15.1

CVE-2013-2251

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-20 Improper Input Validation

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

- BID - 64758
- CISCO - 20131023 Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products
- CONFIRM - http://archiva.apache.org/security.html
- CONFIRM - http://struts.apache.org/release/2.3.x/docs/s2-016.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- FULLDISC - 20131013 Apache Software Foundation A Subsite Remote command execution
- MISC - http://cxsecurity.com/issue/WLB-2014010087
- MLIST - [oss-security] 20140114 Re: CVE Request: Apache Archiva Remote Command Execution 0day
- OSVDB - 98445
- SECTRACK - 1029184
- XF - apache-archiva-ognl-command-exec(90392)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15

CVE-2013-2248

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-20 Improper Input Validation

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

- BID - 64758
- CONFIRM - http://struts.apache.org/release/2.3.x/docs/s2-017.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2
- cpe:/a:apache:struts:2.3.14.3
- cpe:/a:apache:struts:2.3.15

CVE-2013-2135

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

- BID - 64758
- CONFIRM - http://struts.apache.org/development/2.x/docs/s2-015.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
- MISC - https://cwiki.apache.org/confluence/display/WW/S2-015

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2 and all previous versions

CVE-2013-2134

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

- BID - 64758
- CONFIRM - http://struts.apache.org/development/2.x/docs/s2-015.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
- MISC - https://cwiki.apache.org/confluence/display/WW/S2-015

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1
- cpe:/a:apache:struts:2.3.14.2 and all previous versions

CVE-2013-2115

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.

- BID - 60167
- CONFIRM - http://struts.apache.org/development/2.x/docs/s2-014.html
- MISC - https://bugzilla.redhat.com/show_bug.cgi?id=967656
- MISC - https://cwiki.apache.org/confluence/display/WW/S2-014

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14
- cpe:/a:apache:struts:2.3.14.1 and all previous versions

CVE-2013-1966

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

- BID - 60166
- CONFIRM - http://struts.apache.org/development/2.x/docs/s2-013.html
- MISC - https://bugzilla.redhat.com/show_bug.cgi?id=967656
- MISC - https://cwiki.apache.org/confluence/display/WW/S2-013

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14 and all previous versions

CVE-2013-1965

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

- BID - 60082
- CONFIRM - http://struts.apache.org/development/2.x/docs/s2-012.html
- MISC - https://bugzilla.redhat.com/show_bug.cgi?id=967655

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4
- cpe:/a:apache:struts:2.3.4.1
- cpe:/a:apache:struts:2.3.7
- cpe:/a:apache:struts:2.3.8
- cpe:/a:apache:struts:2.3.12
- cpe:/a:apache:struts:2.3.14 and all previous versions
- cpe:/a:apache:struts2-showcase:2.0.0
- cpe:/a:apache:struts2-showcase:2.3.13

CVE-2012-4387

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

- BID - 55346
- CONFIRM - http://struts.apache.org/2.x/docs/s2-011.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3860
- MLIST - [oss-security] 20120901 CVE request: Apache Struts S2-010 and S2-011
- MLIST - [oss-security] 20120901 Re: CVE request: Apache Struts S2-010 and S2-011
- SECUNIA - 50420
- XF - apache-struts-parameters-dos(78183)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4

CVE-2012-4386

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-352

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.

- BID - 55346
- CONFIRM - http://struts.apache.org/2.x/docs/s2-010.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3858
- MLIST - [oss-security] 20120901 CVE request: Apache Struts S2-010 and S2-011
- MLIST - [oss-security] 20120901 Re: CVE request: Apache Struts S2-010 and S2-011
- SECUNIA - 50420
- XF - apache-struts-csrf(78182)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.2.3.1
- cpe:/a:apache:struts:2.3.1
- cpe:/a:apache:struts:2.3.1.1
- cpe:/a:apache:struts:2.3.1.2
- cpe:/a:apache:struts:2.3.3
- cpe:/a:apache:struts:2.3.4

CVE-2012-0838

Severity: High
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-20 Improper Input Validation

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

- CONFIRM - http://struts.apache.org/2.3.1.2/docs/s2-007.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3668
- JVN - JVN#79099262
- JVNDB - JVNDB-2012-000012

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.2.3 and all previous versions
- ...
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3 and all previous versions

CVE-2012-0394

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."

- BUGTRAQ - 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2
- EXPLOIT-DB - 18329
- EXPLOIT-DB - 31434
- MISC - http://struts.apache.org/2.x/docs/s2-008.html
- MISC - http://struts.apache.org/2.x/docs/version-notes-2311.html
- MISC - https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- OSVDB - 78276

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3 and all previous versions

CVE-2012-0393

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

- BUGTRAQ - 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2
- CONFIRM - http://struts.apache.org/2.x/docs/s2-008.html
- CONFIRM - http://struts.apache.org/2.x/docs/version-notes-2311.html
- EXPLOIT-DB - 18329
- MISC - https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- SECUNIA - 47393

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3
- cpe:/a:apache:struts:2.3.1 and all previous versions

CVE-2012-0392

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

- BUGTRAQ - 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2
- CONFIRM - http://struts.apache.org/2.x/docs/s2-008.html
- CONFIRM - http://struts.apache.org/2.x/docs/version-notes-2311.html
- EXPLOIT-DB - 18329
- MISC - https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- MLIST - [dailydave] 20120106 Apache Struts
- SECUNIA - 47393

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3 and all previous versions

CVE-2012-0391

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-20 Improper Input Validation

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

- BUGTRAQ - 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2
- CONFIRM - http://struts.apache.org/2.x/docs/s2-008.html
- CONFIRM - http://struts.apache.org/2.x/docs/version-notes-2311.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3668
- EXPLOIT-DB - 18329
- MISC - https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- SECUNIA - 47393

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3 and all previous versions

CVE-2011-5057

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls

Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."

- CONFIRM - https://issues.apache.org/jira/browse/WW-2264
- CONFIRM - https://issues.apache.org/jira/browse/WW-3631
- MISC - http://codesecure.blogspot.com/2011/12/struts-2-session-tampering-via.html
- SECUNIA - 47109

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:apache:struts:2.2.3 and all previous versions

CVE-2011-2087

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.

- CONFIRM - http://struts.apache.org/2.2.3/docs/version-notes-223.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3597
- CONFIRM - https://issues.apache.org/jira/browse/WW-3608
- VUPEN - ADV-2011-1198

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1

CVE-2011-1772

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

- BID - 47784
- CONFIRM - http://struts.apache.org/2.2.3/docs/version-notes-223.html
- CONFIRM - http://struts.apache.org/2.x/docs/s2-006.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3579
- JVN - JVN#25435092
- JVNDB - JVNDB-2011-000106
- MISC - http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- MISC - http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
- MISC - http://www.ventuneac.net/security-advisories/MVSA-11-006
- VUPEN - ADV-2011-1198

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:opensymphony:webwork
- cpe:/a:opensymphony:xwork

CVE-2010-1870

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

- BID - 41592
- CONFIRM - http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16
- CONFIRM - http://struts.apache.org/2.2.1/docs/s2-005.html
- EXPLOIT-DB - 14360
- FULLDISC - 20100713 CVE-2010-1870: Struts2 remote commands execution
- MISC - http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html
- OSVDB - 66280
- SREASON - 8345

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts:2.1.2
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1

CVE-2008-6504

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.

- BID - 32101
- CONFIRM - http://fisheye6.atlassian.com/cru/CR-9/
- CONFIRM - http://issues.apache.org/struts/browse/WW-2692
- CONFIRM - http://jira.opensymphony.com/browse/XW-641
- CONFIRM - http://struts.apache.org/2.x/docs/s2-003.html
- OSVDB - 49732
- SECUNIA - 32495
- SECUNIA - 32497
- VUPEN - ADV-2008-3003
- VUPEN - ADV-2008-3004
- XF - xwork-parameterinterceptor-security-bypass(46328)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:struts
- ...
- cpe:/a:apache:struts
- cpe:/a:opensymphony:xwork:2.0.0
- cpe:/a:opensymphony:xwork:2.0.1
- cpe:/a:opensymphony:xwork:2.0.2
- cpe:/a:opensymphony:xwork:2.0.3
- cpe:/a:opensymphony:xwork:2.0.4
- cpe:/a:opensymphony:xwork:2.0.5
- cpe:/a:opensymphony:xwork:2.1.0
- cpe:/a:opensymphony:xwork:2.1.1

### EasyPeasy.podspec

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\swift\cocoapods\EasyPeasy.podspec
MD5: f17f3fa4c6eb3e97a6f99902b139eaee
SHA1: a8e94b2992000037764db7f3d2d2d660b7e1f8a7

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | EasyPeasy
podspec | author | "Carlos Vidal" => "nakioparkour@gmail.com"
podspec | homepage | https://github.com/nakiostudio/EasyPeasy
podspec | license | MIT
podspec | name | EasyPeasy
podspec | name_project | EasyPeasy
podspec | version | 0.2.3

#### Identifiers

- None

### Gloss.podspec

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\swift\Gloss\Gloss.podspec
MD5: 4f2a4dc4c1f2e87b164232ab7ed5260f
SHA1: 339ed3206c04892fed1569e6b09a747c169fe065

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | Gloss
podspec | author | "Harlan Kellaway" => "hello@harlankellaway.com"
podspec | homepage | https://github.com/hkellaway/Gloss
podspec | license | :type => "MIT", :file => "LICENSE"
podspec | name | Gloss
podspec | name_project | Gloss
podspec | summary | A shiny JSON parsing library in Swift
podspec | version | 0.7.2

#### Related Dependencies

- Package.swift
  - File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\swift\Gloss\Package.swift
  - SHA1: a8a5183767529757dbc89de4390192efa55c379a
  - MD5: 6a463fa9f6213926387ca59bc63f43bc

#### Identifiers

- None

### uber-1.0-SNAPSHOT.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar
MD5: 634d5cc32238fc3d023941d265189ddd
SHA1: e9a3159254a01777f536d556bcdb539c7617b0e5

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | uber
file | version | 1.0

#### Identifiers

- None

### velocity-1.7.jar

Description: Apache Velocity is a general purpose template engine.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\velocity-1.7.jar
MD5: 3692dd72f8367cb35fb6280dc2916725
SHA1: 2ceb567b8f3f21118ecdec129fe1271dbc09aa7a

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | velocity
central | groupid | org.apache.velocity
central | version | 1.7
file | name | velocity
file | version | 1.7
jar | package name | apache
jar | package name | runtime
jar | package name | velocity
Manifest | Bundle-Name | Apache Velocity
Manifest | bundle-symbolicname | org.apache.velocity
Manifest | Bundle-Version | 1.7
Manifest | extension-name | velocity
Manifest | Implementation-Title | org.apache.velocity
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.7
Manifest | specification-title | Velocity is a Java-based template engine
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | velocity
pom | description | Apache Velocity is a general purpose template engine.
pom | groupid | apache.velocity
pom | name | Apache Velocity
pom | parent-artifactid | apache
pom | parent-groupid | org.apache
pom | parent-version | 1.7
pom | url | http://velocity.apache.org/engine/devel/
pom | version | 1.7

#### Identifiers

- maven: org.apache.velocity:velocity:1.7 Confidence:HIGHEST

### war-4.0.war

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war
MD5: 54070e31aa8e6256ea8c850642a3c434
SHA1: eaede5596599912d70cb9b517cb87fff336a8422

#### Evidence

Source | Name | Value
--- | --- | ---
file | name | war
file | version | 4.0
Manifest | hk2-import-bundles | org.glassfish.main.admingui.console-common,org.glassfish.hk2.hk2,org.glassfish.main.admingui.console-plugin-service, org.glassfish.main.deployment.deployment-client,org.glassfish.main.registration.registration-api,org.glassfish.main.registration.registration-impl, javax.servlet-api, javax.servlet.jsp-api, com.sun.el.javax.el, com.sun.jsftemplating, org.glassfish.main.admingui.dataprovider, com.sun.pkg.client
pom | artifactid | war
pom | groupid | glassfish.main.admingui
pom | name | Admin Console WAR
pom | parent-artifactid | glassfish-parent
pom | parent-groupid | org.glassfish.main
pom | version | 4.0

#### Identifiers

- maven: org.glassfish.main.admingui:war:4.0 Confidence:HIGH

### war-4.0.war: commons-fileupload-1.1.1.jar

Description: The FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

License:

    The Apache Software License, Version 2.0: /LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\commons-fileupload-1.1.1.jar
MD5: adb15d9a4da4a30d77e88b32a45cbddb
SHA1: d587a50727ba905aad13de9ea119081403bf6823

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-fileupload
central | groupid | commons-fileupload
central | version | 1.1.1
file | name | commons-fileupload
file | version | 1.1.1
jar | package name | apache
jar | package name | commons
jar | package name | fileupload
Manifest | extension-name | commons-fileupload
Manifest | Implementation-Title | Commons FileUpload
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.1.1
Manifest | specification-title | Commons FileUpload
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | commons-fileupload
pom | description | The FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.
pom | groupid | commons-fileupload
pom | name | FileUpload
pom | organization name | http://jakarta.apache.org
pom | url | http://jakarta.apache.org/commons/${pom.artifactId.substring(8)}/
pom | version | 1.1.1

#### Identifiers

- maven: commons-fileupload:commons-fileupload:1.1.1 Confidence:HIGHEST
- cpe: cpe:/a:apache:commons_fileupload:1.1.1 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2016-3092

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

- BID - 91453
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743480
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743722
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743738
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1743742
- CONFIRM - http://tomcat.apache.org/security-7.html
- CONFIRM - http://tomcat.apache.org/security-8.html
- CONFIRM - http://tomcat.apache.org/security-9.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1349468
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371
- CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840
- DEBIAN - DSA-3609
- DEBIAN - DSA-3611
- DEBIAN - DSA-3614
- JVN - JVN#89379547
- JVNDB - JVNDB-2016-000121
- MLIST - [dev] 20160621 CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability
- UBUNTU - USN-3024-1
- UBUNTU - USN-3027-1

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:commons_fileupload:1.3.1 and all previous versions
- ...
- cpe:/a:apache:commons_fileupload:1.3.1 and all previous versions
- cpe:/a:apache:tomcat:7.0.0
- cpe:/a:apache:tomcat:7.0.0:beta
- cpe:/a:apache:tomcat:7.0.1
- cpe:/a:apache:tomcat:7.0.2
- cpe:/a:apache:tomcat:7.0.2:beta
- cpe:/a:apache:tomcat:7.0.4
- cpe:/a:apache:tomcat:7.0.4:beta
- cpe:/a:apache:tomcat:7.0.5
- cpe:/a:apache:tomcat:7.0.5:beta
- cpe:/a:apache:tomcat:7.0.6
- cpe:/a:apache:tomcat:7.0.8
- cpe:/a:apache:tomcat:7.0.10
- cpe:/a:apache:tomcat:7.0.11
- cpe:/a:apache:tomcat:7.0.12
- cpe:/a:apache:tomcat:7.0.14
- cpe:/a:apache:tomcat:7.0.16
- cpe:/a:apache:tomcat:7.0.19
- cpe:/a:apache:tomcat:7.0.20
- cpe:/a:apache:tomcat:7.0.21
- cpe:/a:apache:tomcat:7.0.22
- cpe:/a:apache:tomcat:7.0.23
- cpe:/a:apache:tomcat:7.0.25
- cpe:/a:apache:tomcat:7.0.26
- cpe:/a:apache:tomcat:7.0.27
- cpe:/a:apache:tomcat:7.0.28
- cpe:/a:apache:tomcat:7.0.29
- cpe:/a:apache:tomcat:7.0.30
- cpe:/a:apache:tomcat:7.0.32
- cpe:/a:apache:tomcat:7.0.33
- cpe:/a:apache:tomcat:7.0.34
- cpe:/a:apache:tomcat:7.0.35
- cpe:/a:apache:tomcat:7.0.37
- cpe:/a:apache:tomcat:7.0.39
- cpe:/a:apache:tomcat:7.0.40
- cpe:/a:apache:tomcat:7.0.41
- cpe:/a:apache:tomcat:7.0.42
- cpe:/a:apache:tomcat:7.0.47
- cpe:/a:apache:tomcat:7.0.50
- cpe:/a:apache:tomcat:7.0.52
- cpe:/a:apache:tomcat:7.0.53
- cpe:/a:apache:tomcat:7.0.54
- cpe:/a:apache:tomcat:7.0.55
- cpe:/a:apache:tomcat:7.0.56
- cpe:/a:apache:tomcat:7.0.57
- cpe:/a:apache:tomcat:7.0.59
- cpe:/a:apache:tomcat:7.0.61
- cpe:/a:apache:tomcat:7.0.62
- cpe:/a:apache:tomcat:7.0.63
- cpe:/a:apache:tomcat:7.0.64
- cpe:/a:apache:tomcat:7.0.65
- cpe:/a:apache:tomcat:7.0.67
- cpe:/a:apache:tomcat:7.0.68
- cpe:/a:apache:tomcat:7.0.69
- cpe:/a:apache:tomcat:8.0.0:rc1
- cpe:/a:apache:tomcat:8.0.0:rc10
- cpe:/a:apache:tomcat:8.0.0:rc2
- cpe:/a:apache:tomcat:8.0.0:rc5
- cpe:/a:apache:tomcat:8.0.1
- cpe:/a:apache:tomcat:8.0.3
- cpe:/a:apache:tomcat:8.0.5
- cpe:/a:apache:tomcat:8.0.8
- cpe:/a:apache:tomcat:8.0.11
- cpe:/a:apache:tomcat:8.0.12
- cpe:/a:apache:tomcat:8.0.14
- cpe:/a:apache:tomcat:8.0.15
- cpe:/a:apache:tomcat:8.0.17
- cpe:/a:apache:tomcat:8.0.18
- cpe:/a:apache:tomcat:8.0.20
- cpe:/a:apache:tomcat:8.0.21
- cpe:/a:apache:tomcat:8.0.22
- cpe:/a:apache:tomcat:8.0.23
- cpe:/a:apache:tomcat:8.0.24
- cpe:/a:apache:tomcat:8.0.26
- cpe:/a:apache:tomcat:8.0.27
- cpe:/a:apache:tomcat:8.0.28
- cpe:/a:apache:tomcat:8.0.29
- cpe:/a:apache:tomcat:8.0.30
- cpe:/a:apache:tomcat:8.0.32
- cpe:/a:apache:tomcat:8.0.33
- cpe:/a:apache:tomcat:8.0.35
- cpe:/a:apache:tomcat:8.5.0
- cpe:/a:apache:tomcat:8.5.2
- cpe:/a:apache:tomcat:9.0.0:m1
- cpe:/a:apache:tomcat:9.0.0:m3
- cpe:/a:apache:tomcat:9.0.0:m4
- cpe:/a:apache:tomcat:9.0.0:m6
- cpe:/a:hp:icewall_identity_manager:5.0
- cpe:/a:hp:icewall_sso_agent_option:10.0

CVE-2014-0050

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

- BID - 65400
- BUGTRAQ - 20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library
- BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- CONFIRM - http://advisories.mageia.org/MGASA-2014-0110.html
- CONFIRM - http://svn.apache.org/r1565143
- CONFIRM - http://tomcat.apache.org/security-7.html
- CONFIRM - http://tomcat.apache.org/security-8.html
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21669554
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675432
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676091
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676092
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676401
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676403
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676405
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676410
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676656
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676853
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677691
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677724
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681214
- CONFIRM - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
- CONFIRM - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
- CONFIRM - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
- CONFIRM - http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1062337
- FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- HP - HPSBGN03329
- JVN - JVN#14876762
- JVNDB - JVNDB-2014-000017
- MANDRIVA - MDVSA-2015:084
- MISC - http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
- MISC - http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- MLIST - [commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS
- REDHAT - RHSA-2014:0400

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:commons_fileupload:1.1.1
- ...
- cpe:/a:apache:commons_fileupload:1.0
- cpe:/a:apache:commons_fileupload:1.1
- cpe:/a:apache:commons_fileupload:1.1.1
- cpe:/a:apache:commons_fileupload:1.2
- cpe:/a:apache:commons_fileupload:1.2.1
- cpe:/a:apache:commons_fileupload:1.2.2
- cpe:/a:apache:commons_fileupload:1.3 and all previous versions
- cpe:/a:apache:tomcat:7.0.0
- cpe:/a:apache:tomcat:7.0.0:beta
- cpe:/a:apache:tomcat:7.0.1
- cpe:/a:apache:tomcat:7.0.2
- cpe:/a:apache:tomcat:7.0.2:beta
- cpe:/a:apache:tomcat:7.0.3
- cpe:/a:apache:tomcat:7.0.4
- cpe:/a:apache:tomcat:7.0.4:beta
- cpe:/a:apache:tomcat:7.0.5
- cpe:/a:apache:tomcat:7.0.6
- cpe:/a:apache:tomcat:7.0.7
- cpe:/a:apache:tomcat:7.0.8
- cpe:/a:apache:tomcat:7.0.9
- cpe:/a:apache:tomcat:7.0.10
- cpe:/a:apache:tomcat:7.0.11
- cpe:/a:apache:tomcat:7.0.12
- cpe:/a:apache:tomcat:7.0.13
- cpe:/a:apache:tomcat:7.0.14
- cpe:/a:apache:tomcat:7.0.15
- cpe:/a:apache:tomcat:7.0.16
- cpe:/a:apache:tomcat:7.0.17
- cpe:/a:apache:tomcat:7.0.18
- cpe:/a:apache:tomcat:7.0.19
- cpe:/a:apache:tomcat:7.0.20
- cpe:/a:apache:tomcat:7.0.21
- cpe:/a:apache:tomcat:7.0.22
- cpe:/a:apache:tomcat:7.0.23
- cpe:/a:apache:tomcat:7.0.24
- cpe:/a:apache:tomcat:7.0.25
- cpe:/a:apache:tomcat:7.0.26
- cpe:/a:apache:tomcat:7.0.27
- cpe:/a:apache:tomcat:7.0.28
- cpe:/a:apache:tomcat:7.0.29
- cpe:/a:apache:tomcat:7.0.30
- cpe:/a:apache:tomcat:7.0.31
- cpe:/a:apache:tomcat:7.0.32
- cpe:/a:apache:tomcat:7.0.33
- cpe:/a:apache:tomcat:7.0.34
- cpe:/a:apache:tomcat:7.0.35
- cpe:/a:apache:tomcat:7.0.36
- cpe:/a:apache:tomcat:7.0.37
- cpe:/a:apache:tomcat:7.0.38
- cpe:/a:apache:tomcat:7.0.39
- cpe:/a:apache:tomcat:7.0.40
- cpe:/a:apache:tomcat:7.0.41
- cpe:/a:apache:tomcat:7.0.42
- cpe:/a:apache:tomcat:7.0.43
- cpe:/a:apache:tomcat:7.0.44
- cpe:/a:apache:tomcat:7.0.45
- cpe:/a:apache:tomcat:7.0.46
- cpe:/a:apache:tomcat:7.0.47
- cpe:/a:apache:tomcat:7.0.48
- cpe:/a:apache:tomcat:7.0.49
- cpe:/a:apache:tomcat:7.0.50
- cpe:/a:apache:tomcat:8.0.0:rc1
- cpe:/a:apache:tomcat:8.0.0:rc10
- cpe:/a:apache:tomcat:8.0.0:rc2
- cpe:/a:apache:tomcat:8.0.0:rc5
- cpe:/a:apache:tomcat:8.0.1
- cpe:/a:oracle:retail_applications:12.0
- cpe:/a:oracle:retail_applications:12.0in
- cpe:/a:oracle:retail_applications:13.0
- cpe:/a:oracle:retail_applications:13.1
- cpe:/a:oracle:retail_applications:13.2
- cpe:/a:oracle:retail_applications:13.3
- cpe:/a:oracle:retail_applications:13.4
- cpe:/a:oracle:retail_applications:14.0

CVE-2013-0248

Severity: Low
CVSS Score: 3.3 (AV:L/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

- BUGTRAQ - 20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples
- OSVDB - 90906

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:commons_fileupload:1.1.1
- ...
- cpe:/a:apache:commons_fileupload:1.0
- cpe:/a:apache:commons_fileupload:1.1
- cpe:/a:apache:commons_fileupload:1.1.1
- cpe:/a:apache:commons_fileupload:1.2
- cpe:/a:apache:commons_fileupload:1.2.1
- cpe:/a:apache:commons_fileupload:1.2.2

### war-4.0.war: commons-io-1.3.1.jar

Description: Commons-IO contains utility classes, stream implementations, file filters, and endian classes.

License:

    The Apache Software License, Version 2.0: /LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\commons-io-1.3.1.jar
MD5: 2e55c05d3386889af97caae4517ac9df
SHA1: b90b6ac57cf27a2858eaa490d02ba7945d18ca7b

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | commons-io
central | groupid | commons-io
central | version | 1.3.1
file | name | commons-io
file | version | 1.3.1
jar | package name | apache
jar | package name | commons
jar | package name | io
Manifest | extension-name | commons-io
Manifest | Implementation-Title | Commons IO
Manifest | Implementation-Vendor | Apache Software Foundation
Manifest | Implementation-Vendor-Id | org.apache
Manifest | Implementation-Version | 1.3.1
Manifest | specification-title | Commons IO
Manifest | specification-vendor | Apache Software Foundation
pom | artifactid | commons-io
pom | description | Commons-IO contains utility classes, stream implementations, file filters, and endian classes.
pom | groupid | commons-io
pom | name | IO
pom | organization name | http://jakarta.apache.org
pom | url | http://jakarta.apache.org/commons/io/
pom | version | 1.3.1

#### Identifiers

- maven: commons-io:commons-io:1.3.1 Confidence:HIGHEST

### war-4.0.war: dojo-ajax-nodemo-0.4.1.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\dojo-ajax-nodemo-0.4.1.jar
MD5: 91fda9e8b3c95eee6f566567cf790a9e
SHA1: 0e77d6bb7687a7084a1b92da563dfda6324ba83f

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | dojo-ajax-nodemo
central | groupid | com.sun.woodstock.dependlibs
central | version | 0.4.1
file | name | dojo-ajax-nodemo
file | version | 0.4.1
pom | artifactid | dojo-ajax-nodemo
pom | groupid | sun.woodstock.dependlibs
pom | version | 0.4.1

#### Identifiers

- maven: com.sun.woodstock.dependlibs:dojo-ajax-nodemo:0.4.1 Confidence:HIGHEST
- cpe: cpe:/a:sun:woodstock:0.4.1 Confidence:LOW

### war-4.0.war: json-1.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\json-1.0.jar
MD5: a7aa9a187cb901ec6e299f65f583f140
SHA1: 0fe8ce55b9f83f16185192821a385916b0eef38e

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | json
central | groupid | com.sun.woodstock.dependlibs
central | version | 1.0
file | name | json
file | version | 1.0
jar | package name | json
pom | artifactid | json
pom | groupid | sun.woodstock.dependlibs
pom | version | 1.0

#### Identifiers

- maven: com.sun.woodstock.dependlibs:json:1.0 Confidence:HIGHEST
- cpe: cpe:/a:sun:woodstock:1.0 Confidence:LOW

### war-4.0.war: prototype-1.5.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\prototype-1.5.0.jar
MD5: 206bd786024eca29e41a12e44c055c0a
SHA1: b02b002f0e9bb289b311db49c561c58afb8eb58c

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | prototype
central | groupid | com.sun.woodstock.dependlibs
central | version | 1.5.0
file | name | prototype
file | version | 1.5.0
pom | artifactid | prototype
pom | groupid | sun.woodstock.dependlibs
pom | version | 1.5.0

#### Identifiers

- maven: com.sun.woodstock.dependlibs:prototype:1.5.0 Confidence:HIGHEST
- cpe: cpe:/a:sun:woodstock:1.5.0 Confidence:LOW

### war-4.0.war: webui-jsf-4.0.2.10.jar

Description: Project Woodstock

License:

    CDDL + GPLv2 with classpath exception: http://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-4.0.2.10.jar
MD5: 411e6e13bc190d58e10337e502371cfc
SHA1: 977a6fa7f65f8ea68101aa1252c05e8193de97b5

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | webui-jsf
central | groupid | com.sun.woodstock
central | version | 4.0.2.10
file | name | webui-jsf
file | version | 4.0.2.10
jar | package name | jsf
jar | package name | sun
jar | package name | webui
jar (hint) | package name | oracle
Manifest | Implementation-Title | Woodstock 4.0-201201260851-dev
Manifest | Implementation-Vendor | Sun Microsystems Inc.
Manifest | Implementation-Vendor-Id | com.sun
Manifest | Implementation-Version | 4.0-201201260851-dev
Manifest | specification-title | Woodstock
Manifest | specification-vendor | Sun Microsystems Inc.
pom | artifactid | webui-jsf
pom | description | Project Woodstock
pom | groupid | sun.woodstock
pom | name | Project Woodstock
pom | organization name | http://www.oracle.com
pom | url | https://svn.java.net/svn/woodstock~svn/branches/Woodstock_402_Branch
pom | version | 4.0.2.10

#### Identifiers

- maven: com.sun.woodstock:webui-jsf:4.0.2.10 Confidence:HIGHEST

### war-4.0.war: webui-jsf-suntheme-4.0.2.10.jar

Description: Project Woodstock

License:

    CDDL + GPLv2 with classpath exception: http://glassfish.java.net/nonav/public/CDDL+GPL_1_1.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-suntheme-4.0.2.10.jar
MD5: 62a5f094e9832dce2a7ce138dfee3507
SHA1: 4ec663ae9ab37d9d6504dc5754e1e59d36d2cd9e

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | webui-jsf-suntheme
central | groupid | com.sun.woodstock
central | version | 4.0.2.10
file | name | webui-jsf-suntheme
file | version | 4.0.2.10
Manifest | Implementation-Title | Woodstock Components "DEV_4.0" Theme: suntheme
Manifest | Implementation-Vendor | Sun Microsystems, Inc.
Manifest | Implementation-Vendor-Id | com.sun
Manifest | Implementation-Version | "DEV_4.0"
Manifest | specification-title | Woodstock Components Theme: suntheme
Manifest | specification-vendor | Sun Microsystems, Inc.
pom | artifactid | webui-jsf-suntheme
pom | description | Project Woodstock
pom | groupid | sun.woodstock
pom | name | Project Woodstock
pom | organization name | http://www.oracle.com
pom | url | https://svn.java.net/svn/woodstock~svn/branches/Woodstock_402_Branch
pom | version | 4.0.2.10

#### Identifiers

- maven: com.sun.woodstock:webui-jsf-suntheme:4.0.2.10 Confidence:HIGHEST

### war-4.0.war: console-core-4.0.jar

Description: Java.net - The Source for Java Technology Collaboration

License:

    http://glassfish.java.net/nonav/public/CDDL+GPL.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\lib\console-core-4.0.jar
MD5: 34989ef1706408666ee87eec5b55c09b
SHA1: 165c3df4d1ede6f2850e44730cb547dcfdb45a08

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | console-core
central | groupid | org.glassfish.main.admingui
central | version | 4.0
file | name | console-core
file | version | 4.0
manifest | Bundle-Description | Java.net - The Source for Java Technology Collaboration
Manifest | Bundle-Name | Admin Console Core Jar
Manifest | bundle-symbolicname | org.glassfish.main.admingui.console-core
Manifest | Bundle-Version | 4.0.0
pom | artifactid | console-core
pom | groupid | glassfish.main.admingui
pom | name | Admin Console Core Jar
pom | parent-artifactid | admingui
pom | parent-groupid | org.glassfish.main.admingui
pom | version | 4.0

#### Identifiers

- maven: org.glassfish.main.admingui:console-core:4.0 Confidence:HIGHEST

### woden-api-1.0M8.jar

Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\woden-api-1.0M8.jar
MD5: ffa59063e09ee05d3f588adc0dce97bf
SHA1: e15d817dc457976e9ab5ed5b92e14c6f0ff4bcc9

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | woden-api
central | groupid | org.apache.woden
central | version | 1.0M8
file | name | woden-api
file | version | 1.0.m8
manifest | Bundle-Description | The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects ...
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Woden - API
Manifest | bundle-symbolicname | org.apache.woden.woden-api
Manifest | Bundle-Version | 1.0.0
pom | artifactid | woden-api
pom | groupid | apache.woden
pom | name | Woden - API
pom | parent-artifactid | woden
pom | parent-groupid | org.apache.woden
pom | version | 1.0M8

#### Identifiers

- maven: org.apache.woden:woden-api:1.0M8 Confidence:HIGHEST

### woden-impl-dom-1.0M8.jar

Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.

License:

    http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\woden-impl-dom-1.0M8.jar
MD5: 6cefbde48cf35f36ae20f72b6e58a30a
SHA1: a8f543456fc71426e62d003dadf3004b198aceaf

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | woden-impl-dom
central | groupid | org.apache.woden
central | version | 1.0M8
file | name | woden-impl-dom
file | version | 1.0.m8
manifest | Bundle-Description | The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects ...
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | Woden - DOM
Manifest | bundle-symbolicname | org.apache.woden.woden-impl-dom
Manifest | Bundle-Version | 1.0.0
pom | artifactid | woden-impl-dom
pom | groupid | apache.woden
pom | name | Woden - DOM
pom | parent-artifactid | woden
pom | parent-groupid | org.apache.woden
pom | version | 1.0M8

#### Identifiers

- maven: org.apache.woden:woden-impl-dom:1.0M8 Confidence:HIGHEST

### wsdl4j-1.6.2.jar

Description: Java stub generator for WSDL

License:

    CPL: http://www.opensource.org/licenses/cpl1.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\wsdl4j-1.6.2.jar
MD5: 2608a8ea3f07b0c08de8a7d3d0d3fc09
SHA1: dec1669fb6801b7328e01ad72fc9e10b69ea06c1

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | wsdl4j
central | groupid | wsdl4j
central | version | 1.6.2
file | name | wsdl4j
file | version | 1.6.2
jar | package name | extensions
jar | package name | ibm
jar | package name | wsdl
Manifest | Implementation-Title | WSDL4J
Manifest | Implementation-Vendor | IBM
Manifest | Implementation-Version | 1.6
Manifest | specification-title | JWSDL
Manifest | specification-vendor | IBM (Java Community Process)
pom | artifactid | wsdl4j
pom | description | Java stub generator for WSDL
pom | groupid | wsdl4j
pom | name | WSDL4J
pom | url | http://sf.net/projects/wsdl4j
pom | version | 1.6.2

#### Identifiers

- maven: wsdl4j:wsdl4j:1.6.2 Confidence:HIGHEST

### wstx-asl-3.2.4.jar

Description: Woodstox is a high-performance XML processor that implements Stax (JSR-173) API

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\wstx-asl-3.2.4.jar
MD5: f3fac27a7387452f1c4243c695fa0f0d
SHA1: aada03a08ae547bee92caf3b1e0cd756134e9226

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | wstx-asl
central | groupid | org.codehaus.woodstox
central | groupid | woodstox
central | version | 3.2.4
file | name | wstx-asl
file | version | 3.2.4
jar | package name | ctc
jar | package name | wstx
Manifest | Implementation-Title | WoodSToX XML-processor
Manifest | Implementation-Vendor | woodstox.codehaus.org
Manifest | Implementation-Version | 3.2.4
Manifest | specification-title | StAX 1.0 API
Manifest | specification-vendor | http://jcp.org/en/jsr/detail?id=173
pom | artifactid | wstx-asl
pom | description | Woodstox is a high-performance XML processor that implements Stax (JSR-173) API
pom | groupid | codehaus.woodstox
pom | name | Woodstox
pom | organization name | http://www.codehaus.org/
pom | url | http://woodstox.codehaus.org
pom | version | 3.2.4

#### Identifiers

- maven: org.codehaus.woodstox:wstx-asl:3.2.4 Confidence:HIGHEST
- maven: woodstox:wstx-asl:3.2.4 Confidence:HIGHEST

### xalan-2.7.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xalan-2.7.0.jar
MD5: a018d032c21a873225e702b36b171a10
SHA1: a33c0097f1c70b20fa7ded220ea317eb3500515e

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xalan
central | groupid | xalan
central | version | 2.7.0
file | name | xalan
file | version | 2.7.0
jar | package name | apache
jar | package name | xalan
manifest: java_cup/runtime/ | Implementation-Title | runtime
manifest: java_cup/runtime/ | Implementation-Vendor | Princeton University
manifest: java_cup/runtime/ | Implementation-Version | 2.7.0
manifest: java_cup/runtime/ | Specification-Title | Runtime component of JCup
manifest: org/apache/xalan/ | Implementation-Title | org.apache.xalan
manifest: org/apache/xalan/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xalan/ | Implementation-Version | 2.7.0
manifest: org/apache/xalan/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xalan/xsltc/ | Implementation-Title | org.apache.xalan.xsltc
manifest: org/apache/xalan/xsltc/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xalan/xsltc/ | Implementation-Version | 2.7.0
manifest: org/apache/xalan/xsltc/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xml/ | Implementation-Title | org.apache.xml
manifest: org/apache/xml/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xml/ | Implementation-Version | 2.7.0
manifest: org/apache/xpath/ | Implementation-Title | org.apache.xpath
manifest: org/apache/xpath/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xpath/ | Implementation-Version | 2.7.0
pom | artifactid | xalan
pom | groupid | xalan
pom | version | 2.7.0

#### Identifiers

- cpe: cpe:/a:apache:xalan-java:2.7.0 Confidence:HIGHEST
- maven: xalan:xalan:2.7.0 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2014-0107

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

- BID - 66397
- CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1581058
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677145
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680703
- CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681933
- CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- CONFIRM - https://issues.apache.org/jira/browse/XALANJ-2435
- GENTOO - GLSA-201604-02
- MISC - http://www.ocert.org/advisories/ocert-2014-002.html
- REDHAT - RHSA-2014:1351
- XF - apache-xalanjava-cve20140107-sec-bypass(92023)

Vulnerable Software & Versions: (show all)

- cpe:/a:apache:xalan-java:2.7.0
- ...
- cpe:/a:apache:xalan-java:1.0.0
- cpe:/a:apache:xalan-java:2.0.0
- cpe:/a:apache:xalan-java:2.0.1
- cpe:/a:apache:xalan-java:2.1.0
- cpe:/a:apache:xalan-java:2.2.0
- cpe:/a:apache:xalan-java:2.4.0
- cpe:/a:apache:xalan-java:2.4.1
- cpe:/a:apache:xalan-java:2.5.0
- cpe:/a:apache:xalan-java:2.5.1
- cpe:/a:apache:xalan-java:2.5.2
- cpe:/a:apache:xalan-java:2.6.0
- cpe:/a:apache:xalan-java:2.7.0
- cpe:/a:apache:xalan-java:2.7.1 and all previous versions
- cpe:/a:oracle:webcenter_sites:7.6.2
- cpe:/a:oracle:webcenter_sites:11.1.1.8.0

### xercesImpl-2.8.1.jar

Description: Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xercesImpl-2.8.1.jar
MD5: e86f321c8191b37bd720ff5679f57288
SHA1: 25101e37ec0c907db6f0612cbf106ee519c1aef1

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xercesImpl
central | groupid | xerces
central | version | 2.8.1
file | name | xercesImpl
file | version | 2.8.1
jar | package name | apache
jar | package name | xerces
manifest: javax/xml/datatype/ | Implementation-Title | javax.xml.datatype
manifest: javax/xml/datatype/ | Implementation-Vendor | Apache Software Foundation
manifest: javax/xml/datatype/ | Implementation-Version | 1.3.03
manifest: javax/xml/datatype/ | Specification-Title | Java API for XML Processing
manifest: javax/xml/parsers/ | Implementation-Title | javax.xml.parsers
manifest: javax/xml/parsers/ | Implementation-Vendor | Apache Software Foundation
manifest: javax/xml/parsers/ | Implementation-Version | 1.3.03
manifest: javax/xml/parsers/ | Specification-Title | Java API for XML Processing
manifest: javax/xml/transform/ | Implementation-Title | javax.xml.transform
manifest: javax/xml/transform/ | Implementation-Vendor | Apache Software Foundation
manifest: javax/xml/transform/ | Implementation-Version | 1.3.03
manifest: javax/xml/transform/ | Specification-Title | Java API for XML Processing
manifest: javax/xml/validation/ | Implementation-Title | javax.xml.validation
manifest: javax/xml/validation/ | Implementation-Vendor | Apache Software Foundation
manifest: javax/xml/validation/ | Implementation-Version | 1.3.03
manifest: javax/xml/validation/ | Specification-Title | Java API for XML Processing
manifest: javax/xml/xpath/ | Implementation-Title | javax.xml.xpath
manifest: javax/xml/xpath/ | Implementation-Vendor | Apache Software Foundation
manifest: javax/xml/xpath/ | Implementation-Version | 1.3.03
manifest: javax/xml/xpath/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xerces/impl/Version.class | Implementation-Title | org.apache.xerces.impl.Version
manifest: org/apache/xerces/impl/Version.class | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xerces/impl/Version.class | Implementation-Version | 2.8.1
manifest: org/apache/xerces/xni/ | Implementation-Title | org.apache.xerces.xni
manifest: org/apache/xerces/xni/ | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xerces/xni/ | Implementation-Version | 1.2
manifest: org/apache/xerces/xni/ | Specification-Title | Xerces Native Interface
manifest: org/w3c/dom/ | Implementation-Title | org.w3c.dom
manifest: org/w3c/dom/ | Implementation-Vendor | World Wide Web Consortium
manifest: org/w3c/dom/ | Implementation-Version | 1.0
manifest: org/w3c/dom/ | Specification-Title | Document Object Model, Level 3 Core
manifest: org/w3c/dom/ls/ | Implementation-Title | org.w3c.dom.ls
manifest: org/w3c/dom/ls/ | Implementation-Vendor | World Wide Web Consortium
manifest: org/w3c/dom/ls/ | Implementation-Version | 1.0
manifest: org/w3c/dom/ls/ | Specification-Title | Document Object Model, Level 3 Load and Save
manifest: org/xml/sax/ | Implementation-Title | org.xml.sax
manifest: org/xml/sax/ | Implementation-Vendor | David Megginson
manifest: org/xml/sax/ | Implementation-Version | 2.0.2
manifest: org/xml/sax/ | Specification-Title | Simple API for XML
pom | artifactid | xercesImpl
pom | description | Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.
pom | groupid | xerces
pom | name | Xerces2 Java Parser
pom | parent-artifactid | apache
pom | parent-groupid | org.apache
pom | parent-version | 2.8.1
pom | url | http://xerces.apache.org/xerces2-j/
pom | version | 2.8.1

#### Identifiers

- maven: xerces:xercesImpl:2.8.1 Confidence:HIGHEST

### xml-apis-1.0.b2.jar

Description: xml-commons provides an Apache-hosted set of DOM, SAX, and JAXP interfaces for use in other xml-based projects. Our hope is that we can standardize on both a common version and packaging scheme for these critical XML standards interfaces to make the lives of both our developers and users easier. The External Components portion of xml-commons contains interfaces that are defined by external standards organizations. For DOM, that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for JAXP it's Sun.

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xml-apis-1.0.b2.jar
MD5: 458715c0f7646a56b1c6ad3138098beb
SHA1: 3136ca936f64c9d68529f048c2618bd356bf85c9

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xml-apis
central | groupid | xml-apis
central | version | 1.0.b2
central | version | 2.0.0
central | version | 2.0.2
file | name | xml-apis
file | version | 1.0.b2
jar | package name | dom
jar | package name | w3c
manifest: javax/xml/parsers/ | Implementation-Title | javax.xml.transform
manifest: javax/xml/parsers/ | Implementation-Vendor | Sun Microsystems Inc.
manifest: javax/xml/parsers/ | Implementation-Version | 1.1.2
manifest: javax/xml/parsers/ | Specification-Title | Java API for XML Processing
manifest: javax/xml/transform/ | Implementation-Title | javax.xml.transform
manifest: javax/xml/transform/ | Implementation-Vendor | Sun Microsystems Inc.
manifest: javax/xml/transform/ | Implementation-Version | 1.1.2
manifest: javax/xml/transform/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xmlcommons/Version | Implementation-Title | org.apache.xmlcommons.Version
manifest: org/apache/xmlcommons/Version | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xmlcommons/Version | Implementation-Version | 1.0.b2
manifest: org/w3c/dom/ | Implementation-Title | org.w3c.dom
manifest: org/w3c/dom/ | Implementation-Vendor | World Wide Web Consortium
manifest: org/w3c/dom/ | Implementation-Version | 1.0
manifest: org/w3c/dom/ | Specification-Title | Document Object Model, Level 2 Core
manifest: org/xml/sax/ | Implementation-Title | org.xml.sax
manifest: org/xml/sax/ | Implementation-Vendor | David Megginson
manifest: org/xml/sax/ | Implementation-Version | 2.0
manifest: org/xml/sax/ | Specification-Title | Simple API for XML
pom | artifactid | xml-apis
pom | description | xml-commons provides an Apache-hosted set of DOM, SAX, and JAXP interfaces for use in other xml-based projects. Our hope is that we can standardize on both a common version and packaging scheme for these critical XML standards interfaces to make the lives of both our developers and users easier. The External Components portion of xml-commons contains interfaces that are defined by external standards organizations. For DOM, that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for JAXP it's Sun.
pom | groupid | xml-apis
pom | name | XML Commons External Components XML APIs
pom | organization name | http://www.apache.org/
pom | url | http://xml.apache.org/commons/#external
pom | version | 1.0.b2

#### Identifiers

- maven: xml-apis:xml-apis:1.0.b2 Confidence:HIGHEST
- maven: xml-apis:xml-apis:2.0.0 Confidence:HIGHEST
- maven: xml-apis:xml-apis:2.0.2 Confidence:HIGHEST

### xmlParserAPIs-2.6.0.jar

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xmlParserAPIs-2.6.0.jar
MD5: 2651f9f7c39e3524f3e2c394625ac63a
SHA1: 065acede1e5305bd2b92213d7b5761328c6f4fd9

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xmlParserAPIs
central | groupid | xerces
central | version | 2.6.0
central | version | 2.6.1
central | version | 2.6.2
file | name | xmlParserAPIs
file | version | 2.6.0
jar | package name | dom
jar | package name | w3c
manifest: javax/xml/parsers/ | Implementation-Title | javax.xml.transform
manifest: javax/xml/parsers/ | Implementation-Vendor | Sun Microsystems Inc.
manifest: javax/xml/parsers/ | Implementation-Version | 1.2.01
manifest: javax/xml/parsers/ | Specification-Title | Java API for XML Processing
manifest: javax/xml/transform/ | Implementation-Title | javax.xml.transform
manifest: javax/xml/transform/ | Implementation-Vendor | Sun Microsystems Inc.
manifest: javax/xml/transform/ | Implementation-Version | 1.2.01
manifest: javax/xml/transform/ | Specification-Title | Java API for XML Processing
manifest: org/apache/xmlcommons/Version | Implementation-Title | org.apache.xmlcommons.Version
manifest: org/apache/xmlcommons/Version | Implementation-Vendor | Apache Software Foundation
manifest: org/apache/xmlcommons/Version | Implementation-Version | 1.2.01
manifest: org/w3c/dom/ | Implementation-Title | org.w3c.dom
manifest: org/w3c/dom/ | Implementation-Vendor | World Wide Web Consortium
manifest: org/w3c/dom/ | Implementation-Version | 1.0
manifest: org/w3c/dom/ | Specification-Title | Document Object Model, Level 2 Core
manifest: org/xml/sax/ | Implementation-Title | org.xml.sax
manifest: org/xml/sax/ | Implementation-Vendor | David Megginson
manifest: org/xml/sax/ | Implementation-Version | 2.0.1
manifest: org/xml/sax/ | Specification-Title | Simple API for XML
pom | artifactid | xmlParserAPIs
pom | groupid | xerces
pom | version | 2.6.1

#### Identifiers

- maven: xerces:xmlParserAPIs:2.6.0 Confidence:HIGHEST
- maven: xerces:xmlParserAPIs:2.6.1 Confidence:HIGHEST
- maven: xerces:xmlParserAPIs:2.6.2 Confidence:HIGHEST

### xmlpull-1.1.3.1.jar

License:

    Public Domain: http://www.xmlpull.org/v1/download/unpacked/LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xmlpull-1.1.3.1.jar
MD5: cc57dacc720eca721a50e78934b822d2
SHA1: 2b8e230d2ab644e4ecaa94db7cdedbc40c805dfa

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xmlpull
central | groupid | xmlpull
central | version | 1.1.3.1
file | name | xmlpull
file | version | 1.1.3.1
jar | package name | v1
jar | package name | xmlpull
pom | artifactid | xmlpull
pom | groupid | xmlpull
pom | name | XML Pull Parsing API
pom | url | http://www.xmlpull.org
pom | version | 1.1.3.1

#### Identifiers

- maven: xmlpull:xmlpull:1.1.3.1 Confidence:HIGHEST

### XmlSchema-1.4.2.jar

Description: Commons XMLSchema is a light weight schema object model that can be used to manipualte or generate a schema. It has a clean, easy to use API and can easily be integrated into an existing project since it has almost no dependancies on third party libraries.

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\XmlSchema-1.4.2.jar
MD5: ced8c8555d4e965cf7ce06459730479a
SHA1: 7cf868b0d6a5b68be0dea014126b986b3387755a

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | XmlSchema
central | groupid | org.apache.ws.commons.schema
central | groupid | org.apache.ws.schema
central | version | 1.4.2
file | name | XmlSchema
file | version | 1.4.2
Manifest | bundle-docurl | http://www.apache.org/
Manifest | Bundle-Name | XmlSchema
Manifest | bundle-symbolicname | org.apache.ws.commons.schema
Manifest | Bundle-Version | 1.4.2
pom | artifactid | XmlSchema
pom | description | Commons XMLSchema is a light weight schema object model that can be used to manipualte or generate a schema. It has a clean, easy to use API and can easily be integrated into an existing project since it has almost no dependancies on third party libraries.
pom | groupid | apache.ws.commons.schema
pom | name | XmlSchema
pom | organization name | http://www.apache.org/
pom | url | http://ws.apache.org/commons/XmlSchema
pom | version | 1.4.2

#### Identifiers

- maven: org.apache.ws.commons.schema:XmlSchema:1.4.2 Confidence:HIGHEST
- maven: org.apache.ws.schema:XmlSchema:1.4.2 Confidence:HIGHEST

### xpp3_min-1.1.4c.jar

Description: MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs such as Hotspot in JDK 1.4+.

License:

    Indiana University Extreme! Lab Software License, vesion 1.1.1: http://www.extreme.indiana.edu/viewcvs/~checkout~/XPP3/java/LICENSE.txt
    Public Domain: http://creativecommons.org/licenses/publicdomain

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xpp3_min-1.1.4c.jar
MD5: dcd95bcb84b09897b2b66d4684c040da
SHA1: 19d4e90b43059058f6e056f794f0ea4030d60b86

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xpp3_min
central | groupid | xpp3
central | version | 1.1.4c
file | name | xpp3_min
file | version | 1.1.4c
jar | package name | v1
jar | package name | xmlpull
pom | artifactid | xpp3_min
pom | description | MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ...
pom | groupid | xpp3
pom | name | MXP1: Xml Pull Parser 3rd Edition (XPP3)
pom | organization name | http://www.extreme.indiana.edu/
pom | url | http://www.extreme.indiana.edu/xgws/xsoap/xpp/mxp1/
pom | version | 1.1.4c

#### Identifiers

- maven: xpp3:xpp3_min:1.1.4c Confidence:HIGHEST

### xstream-1.4.8.jar

Description: XStream is a serialization library from Java objects to XML and back.

License:

    http://xstream.codehaus.org/license.html

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xstream-1.4.8.jar
MD5: 4551a29c38f22ed25eaf109eda50ff03
SHA1: 520d90f30f36a0d6ba2dc929d980831631ad6a92

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xstream
central | groupid | com.thoughtworks.xstream
central | version | 1.4.8
file | name | xstream
file | version | 1.4.8
manifest | Bundle-Description | XStream is a serialization library from Java objects to XML and back.
Manifest | bundle-docurl | http://xstream.codehaus.org
Manifest | Bundle-Name | XStream Core
Manifest | bundle-symbolicname | xstream
Manifest | Bundle-Version | 1.4.8
Manifest | Implementation-Title | XStream Core
Manifest | Implementation-Vendor | XStream
Manifest | Implementation-Vendor-Id | com.thoughtworks.xstream
Manifest | Implementation-Version | 1.4.8
Manifest | specification-title | XStream Core
Manifest | specification-vendor | XStream
Manifest | x-build-time | 2015-02-18T19:07:02Z
Manifest | x-builder | 3.2.5
Manifest | x-builder | Maven 3.2.5
Manifest | x-compile-source | 1.5
Manifest | x-compile-target | 1.5
pom | artifactid | xstream
pom | groupid | thoughtworks.xstream
pom | name | XStream Core
pom | parent-artifactid | xstream-parent
pom | parent-groupid | com.thoughtworks.xstream
pom | version | 1.4.8

#### Identifiers

- maven: com.thoughtworks.xstream:xstream:1.4.8 Confidence:HIGHEST
- cpe: cpe:/a:x-stream:xstream:1.4.8 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2016-3674

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

- CONFIRM - http://x-stream.github.io/changes.html#1.4.9
- CONFIRM - https://github.com/x-stream/xstream/issues/25
- DEBIAN - DSA-3575
- MLIST - [oss-security] 20160325 CVE request - XStream: XXE vulnerability
- MLIST - [oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability

Vulnerable Software & Versions:

- cpe:/a:x-stream:xstream:1.4.8 and all previous versions

### xwork-2.1.1.jar

Description: XWork is an command-pattern framework that is used to power WebWork as well as other applications. XWork provides an Inversion of Control container, a powerful expression language, data type conversion, validation, and pluggable configuration.

License:

    The OpenSymphony Software License 1.1: src/etc/LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\xwork-2.1.1.jar
MD5: fed42fc127540dbbf88fb4ee80a2c039
SHA1: e509a9c3a66ae7b26b56cce0657ca2550aa43512

#### Evidence

Source | Name | Value
--- | --- | ---
central | artifactid | xwork
central | groupid | com.opensymphony
central | version | 2.1.1
file | name | xwork
file | version | 2.1.1
jar | package name | opensymphony
jar | package name | xwork2
pom | artifactid | xwork
pom | description | XWork is an command-pattern framework that is used to power WebWork as well as other applications. XWork provides an Inversion of Control container, a powerful expression language, data type conversion, validation, and pluggable configuration.
pom | groupid | opensymphony
pom | name | XWork
pom | organization name | http://www.opensymphony.com/
pom | url | http://www.opensymphony.com/xwork/
pom | version | 2.1.1

#### Identifiers

- maven: com.opensymphony:xwork:2.1.1 Confidence:HIGHEST
- cpe: cpe:/a:opensymphony:xwork:2.1.1 Confidence:HIGHEST

#### Published Vulnerabilities

CVE-2011-2088

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.

- BUGTRAQ - 20110518 Apache Struts 2, XWork, OpenSymphony WebWork Java Class Path Information Disclosure
- MISC - http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- MISC - http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
- MISC - http://www.ventuneac.net/security-advisories/MVSA-11-006
- MISC - https://issues.apache.org/jira/browse/WW-3579

Vulnerable Software & Versions: (show all)

- cpe:/a:opensymphony:xwork:-
- ...
- cpe:/a:apache:struts:2.2.1
- cpe:/a:opensymphony:webwork:-
- cpe:/a:opensymphony:xwork:-
- cpe:/a:opensymphony:xwork:2.2.1

CVE-2011-1772

Severity: Low
CVSS Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

- BID - 47784
- CONFIRM - http://struts.apache.org/2.2.3/docs/version-notes-223.html
- CONFIRM - http://struts.apache.org/2.x/docs/s2-006.html
- CONFIRM - https://issues.apache.org/jira/browse/WW-3579
- JVN - JVN#25435092
- JVNDB - JVNDB-2011-000106
- MISC - http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- MISC - http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
- MISC - http://www.ventuneac.net/security-advisories/MVSA-11-006
- VUPEN - ADV-2011-1198

Vulnerable Software & Versions: (show all)

- cpe:/a:opensymphony:xwork
- ...
- cpe:/a:apache:struts:2.0.0
- cpe:/a:apache:struts:2.0.1
- cpe:/a:apache:struts:2.0.2
- cpe:/a:apache:struts:2.0.3
- cpe:/a:apache:struts:2.0.4
- cpe:/a:apache:struts:2.0.5
- cpe:/a:apache:struts:2.0.6
- cpe:/a:apache:struts:2.0.7
- cpe:/a:apache:struts:2.0.8
- cpe:/a:apache:struts:2.0.9
- cpe:/a:apache:struts:2.0.10
- cpe:/a:apache:struts:2.0.11
- cpe:/a:apache:struts:2.0.11.1
- cpe:/a:apache:struts:2.0.11.2
- cpe:/a:apache:struts:2.0.12
- cpe:/a:apache:struts:2.0.13
- cpe:/a:apache:struts:2.0.14
- cpe:/a:apache:struts:2.1.0
- cpe:/a:apache:struts:2.1.1
- cpe:/a:apache:struts:2.1.2
- cpe:/a:apache:struts:2.1.3
- cpe:/a:apache:struts:2.1.4
- cpe:/a:apache:struts:2.1.5
- cpe:/a:apache:struts:2.1.6
- cpe:/a:apache:struts:2.1.8
- cpe:/a:apache:struts:2.1.8.1
- cpe:/a:apache:struts:2.2.1
- cpe:/a:apache:struts:2.2.1.1
- cpe:/a:opensymphony:webwork
- cpe:/a:opensymphony:xwork

CVE-2008-6504

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-20 Improper Input Validation

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.

- BID - 32101
- CONFIRM - http://fisheye6.atlassian.com/cru/CR-9/
- CONFIRM - http://issues.apache.org/struts/browse/WW-2692
- CONFIRM - http://jira.opensymphony.com/browse/XW-641
- CONFIRM - http://struts.apache.org/2.x/docs/s2-003.html
- OSVDB - 49732
- SECUNIA - 32495
- SECUNIA - 32497
- VUPEN - ADV-2008-3003
- VUPEN - ADV-2008-3004
- XF - xwork-parameterinterceptor-security-bypass(46328)

Vulnerable Software & Versions: (show all)

- cpe:/a:opensymphony:xwork:2.1.1
- ...
- cpe:/a:apache:struts
- cpe:/a:opensymphony:xwork:2.0.0
- cpe:/a:opensymphony:xwork:2.0.1
- cpe:/a:opensymphony:xwork:2.0.2
- cpe:/a:opensymphony:xwork:2.0.3
- cpe:/a:opensymphony:xwork:2.0.4
- cpe:/a:opensymphony:xwork:2.0.5
- cpe:/a:opensymphony:xwork:2.1.0
- cpe:/a:opensymphony:xwork:2.1.1

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-core/pom.xml

Description: The core functionality of Hibernate

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-core/pom.xml
MD5: bd41ed501d7218dc30403320127372f2
SHA1: 7d8f09aa7d0100318d826625cb42dbc358e07abd

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-core
pom | description | The core functionality of Hibernate
pom | groupid | hibernate
pom | name | Hibernate Core
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-core:3.6.6.Final Confidence:HIGH

### junit4-ant-2.0.13.jar\META-INF/maven/com.google.guava/guava/pom.xml

Description: Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has two code dependencies - javax.annotation per the JSR-305 spec and javax.inject per the JSR-330 spec.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\junit4-ant-2.0.13.jar\META-INF/maven/com.google.guava/guava/pom.xml
MD5: b9406eec5781ea391a26972c394bf129
SHA1: 7b4c8f117c11a8f1fcaf4f1b0fd07cbe756a1430

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | guava
pom | description | Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has two code dependencies - javax.annotation per the JSR-305 spec and javax.inject per the JSR-330 spec.
pom | groupid | google.guava
pom | name | Guava: Google Core Libraries for Java
pom | parent-artifactid | guava-parent
pom | parent-groupid | com.google.guava
pom | version | 14.0.1

#### Identifiers

- maven: com.google.guava:guava:14.0.1 Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-commons-annotations/pom.xml

Description: Common reflection code used in support of annotation processing

License:

    GNU LESSER GENERAL PUBLIC LICENSE: http://www.gnu.org/licenses/lgpl.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-commons-annotations/pom.xml
MD5: 08b54aba75a160ec63d3677d89b2a9bb
SHA1: 4665e68571641943c1a12ed16a1b7c05c6c40943

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-commons-annotations
pom | description | Common reflection code used in support of annotation processing
pom | groupid | hibernate
pom | name | Hibernate Commons Annotations
pom | organization name | http://hibernate.org
pom | url | http://hibernate.org
pom | version | 3.2.0.Final

#### Identifiers

- maven: org.hibernate:hibernate-commons-annotations:3.2.0.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-ehcache/pom.xml

Description: Integration of Hibernate with Ehcache

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-ehcache/pom.xml
MD5: 19610cc4510ae1067e83e910590ca011
SHA1: 9218f8cd87f3e28c49d4947361b4c6f66757cc25

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-ehcache
pom | description | Integration of Hibernate with Ehcache
pom | groupid | hibernate
pom | name | Hibernate Ehcache Integration
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-ehcache:3.6.6.Final Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.owasp.dependency-check/uber/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.owasp.dependency-check/uber/pom.xml
MD5: 2c67a7108125ede340218e9deba58e82
SHA1: 52fb11f0fc1666a343aa5c5ea0f756ba54934c1f

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | uber
pom | groupid | owasp.dependency-check
pom | name | uber
pom | url | http://maven.apache.org
pom | version | 1.0-SNAPSHOT

#### Identifiers

- maven: org.owasp.dependency-check:uber:1.0-SNAPSHOT Confidence:HIGH

### junit4-ant-2.0.13.jar\META-INF/maven/commons-io/commons-io/pom.xml

Description: The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\junit4-ant-2.0.13.jar\META-INF/maven/commons-io/commons-io/pom.xml
MD5: 55cd2592053f21df9e9bda556fb1a997
SHA1: 8d5ab37f6f72fbba8052e21013c49eddc32fa724

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | commons-io
pom | description | The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
pom | groupid | commons-io
pom | name | Commons IO
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 2.3
pom | url | http://commons.apache.org/io/
pom | version | 2.3

#### Identifiers

- maven: commons-io:commons-io:2.3 Confidence:HIGH

### junit4-ant-2.0.13.jar\META-INF/maven/org.simpleframework/simple-xml/pom.xml

Description: Simple is a high performance XML serialization and configuration framework for Java

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\junit4-ant-2.0.13.jar\META-INF/maven/org.simpleframework/simple-xml/pom.xml
MD5: 92ffae01f39ead03e459e68046b071c0
SHA1: 1bdb68c2ba8dedea76c485a09c805f4c8739373e

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | simple-xml
pom | description | Simple is a high performance XML serialization and configuration framework for Java
pom | groupid | simpleframework
pom | name | Simple XML
pom | url | http://simple.sourceforge.net
pom | version | 2.6.2

#### Identifiers

- maven: org.simpleframework:simple-xml:2.6.2 Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-jbosscache/pom.xml

Description: Integration of Hibernate with JBossCache 3.x (though 2.x sould work as well)

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-jbosscache/pom.xml
MD5: 339d8af2672ed9e1bef0e04649a33f46
SHA1: ef975161e9c45b177283d9105220f791ed512aea

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-jbosscache
pom | description | Integration of Hibernate with JBossCache 3.x (though 2.x sould work as well)
pom | groupid | hibernate
pom | name | Hibernate JBossCache Integration
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-jbosscache:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-infinispan/pom.xml

Description: Integration of Hibernate with Infinispan

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-infinispan/pom.xml
MD5: 2cc34e9876b4c73c4d9876e784e78e5d
SHA1: bd2454348c57618c3e02b329a6822d5979d3c871

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-infinispan
pom | description | Integration of Hibernate with Infinispan
pom | groupid | hibernate
pom | name | Hibernate Infinispan Integration
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-infinispan:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-testing/pom.xml

Description: Hibernate JUnit test utilities

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-testing/pom.xml
MD5: 6cad956c9362f77504bf2d9aaf1731ee
SHA1: b8710fde765268f33442497aace2848f4fa986f4

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-testing
pom | description | Hibernate JUnit test utilities
pom | groupid | hibernate
pom | name | Hibernate Testing
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-testing:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-oscache/pom.xml

Description: Integration of Hibernate with OSCache

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-oscache/pom.xml
MD5: 97443939f6f7e9c45375397aac16e0b9
SHA1: 4aadcf3391317e2a62332e9fd801b8284c3d985c

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-oscache
pom | description | Integration of Hibernate with OSCache
pom | groupid | hibernate
pom | name | Hibernate OSCache Integration
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-oscache:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-swarmcache/pom.xml

Description: Integration of Hibernate with SwarmCache

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-swarmcache/pom.xml
MD5: 6e1b739de3e65236403d0eb82db58243
SHA1: aa700e6e775c476182a1e1ad0f15c63cdb537fe0

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-swarmcache
pom | description | Integration of Hibernate with SwarmCache
pom | groupid | hibernate
pom | name | Hibernate SwarmCache Integration
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-swarmcache:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-c3p0/pom.xml

Description: C3P0-based implementation of the Hibernate ConnectionProvder contract

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-c3p0/pom.xml
MD5: 301251db8497b5100b7d6e9efb0afc44
SHA1: 55119c84a43a9af05482e077ab241cacd1910d93

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-c3p0
pom | description | C3P0-based implementation of the Hibernate ConnectionProvder contract
pom | groupid | hibernate
pom | name | Hibernate C3P0 ConnectionProvider
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-c3p0:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-proxool/pom.xml

Description: Proxool-based implementation of the Hibernate ConnectionProvder contract

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-proxool/pom.xml
MD5: d1749afd6014c4465a13a87583429af2
SHA1: 5a4af64267474034f5d844e6a0af599aea7b746f

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-proxool
pom | description | Proxool-based implementation of the Hibernate ConnectionProvder contract
pom | groupid | hibernate
pom | name | Hibernate Proxool ConnectionProvider
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-proxool:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-entitymanager/pom.xml

Description: Hibernate Entity Manager

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-entitymanager/pom.xml
MD5: 68c7e92964df6fab1e9082d29a78d9c4
SHA1: 38d087e745fa330ad03fd5ab3e2d029845913de7

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-entitymanager
pom | description | Hibernate Entity Manager
pom | groupid | hibernate
pom | name | Hibernate Entity Manager
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-entitymanager:3.6.6.Final Confidence:HIGH

### hibernate3.jar\META-INF/maven/org.hibernate/hibernate-envers/pom.xml

Description: Support for entity auditing

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-envers/pom.xml
MD5: 897a79ec7b20d46002f0bbc441ed1ca9
SHA1: 02094fd8813c1b0b43b0e4d36df791ea80cfced1

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-envers
pom | description | Support for entity auditing
pom | groupid | hibernate
pom | name | Hibernate Envers
pom | parent-artifactid | hibernate-parent
pom | parent-groupid | org.hibernate
pom | version | 3.6.6.Final

#### Identifiers

- maven: org.hibernate:hibernate-envers:3.6.6.Final Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/commons-io/commons-io/pom.xml

Description: Commons-IO contains utility classes, stream implementations, file filters, and endian classes.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/commons-io/commons-io/pom.xml
MD5: 92beb726a369cb3ce2503796f98e2f3b
SHA1: d30e29bee45e6da52a776266a460f10b51ceca98

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | commons-io
pom | description | Commons-IO contains utility classes, stream implementations, file filters, and endian classes.
pom | groupid | commons-io
pom | name | Commons IO
pom | parent-artifactid | commons-parent
pom | parent-groupid | org.apache.commons
pom | parent-version | 1.3.2
pom | url | http://jakarta.apache.org/commons/io/
pom | version | 1.3.2

#### Identifiers

- maven: commons-io:commons-io:1.3.2 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.dropwizard/dropwizard-core/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.dropwizard/dropwizard-core/pom.xml
MD5: 818fd048671bd58716cd687cdcd79ba4
SHA1: 905a71014bc2ba9e893107268ba8227528f31617

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | dropwizard-core
pom | groupid | yammer.dropwizard
pom | name | Dropwizard
pom | parent-artifactid | dropwizard-parent
pom | parent-groupid | com.yammer.dropwizard
pom | version | 0.1.3

#### Identifiers

- maven: com.yammer.dropwizard:dropwizard-core:0.1.3 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-core/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-core/pom.xml
MD5: ff77b5aceaf6d73a121bcb471444f071
SHA1: e1c1339fa2c342aa5a24dcdd3658c00a2139263a

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jersey-core
pom | groupid | sun.jersey
pom | name | jersey-core
pom | parent-artifactid | jersey-project
pom | parent-groupid | com.sun.jersey
pom | version | 1.11

#### Identifiers

- maven: com.sun.jersey:jersey-core:1.11 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-server/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-server/pom.xml
MD5: 07a7be16c32692944c7fe8dcc8685d3c
SHA1: baffe4cdc261e43b5e727d47a5f92691a473ca78

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jersey-server
pom | groupid | sun.jersey
pom | name | jersey-server
pom | parent-artifactid | jersey-project
pom | parent-groupid | com.sun.jersey
pom | version | 1.11

#### Identifiers

- maven: com.sun.jersey:jersey-server:1.11 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-servlet/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-servlet/pom.xml
MD5: ed005c0838de5f8a6e0fe6ef31b827a0
SHA1: f1c4462e1f967afe6c150b3955b72c71780e2916

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jersey-servlet
pom | groupid | sun.jersey
pom | name | jersey-servlet
pom | parent-artifactid | jersey-project
pom | parent-groupid | com.sun.jersey
pom | version | 1.11

#### Identifiers

- maven: com.sun.jersey:jersey-servlet:1.11 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-core/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-core/pom.xml
MD5: 726812bd630cb75b3cadf40346c669e9
SHA1: c04a80a736ae29268265e22aa7e21dea68c63d1b

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | metrics-core
pom | groupid | yammer.metrics
pom | name | Metrics Core Library
pom | parent-artifactid | metrics-parent
pom | parent-groupid | com.yammer.metrics
pom | version | 2.0.0-RC0

#### Identifiers

- maven: com.yammer.metrics:metrics-core:2.0.0-RC0 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-servlet/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-servlet/pom.xml
MD5: f71c2da1da38a5d505d892c2fe6022d2
SHA1: 838aaae3f56141a6e35e87003d90f1c7132f839c

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | metrics-servlet
pom | groupid | yammer.metrics
pom | name | Metrics Servlet
pom | parent-artifactid | metrics-parent
pom | parent-groupid | com.yammer.metrics
pom | version | 2.0.0-RC0

#### Identifiers

- maven: com.yammer.metrics:metrics-servlet:2.0.0-RC0 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jetty/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jetty/pom.xml
MD5: 994485bf6db4621a698290e213f0838e
SHA1: 3d4c7ee060f83ca829ee3ef22900e3af49579f53

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | metrics-jetty
pom | groupid | yammer.metrics
pom | name | Metrics Jetty Support
pom | parent-artifactid | metrics-parent
pom | parent-groupid | com.yammer.metrics
pom | version | 2.0.0-RC0

#### Identifiers

- maven: com.yammer.metrics:metrics-jetty:2.0.0-RC0 Confidence:HIGH
- cpe: cpe:/a:jetty:jetty:2.0.0.rc0 Confidence:LOW

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-log4j/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-log4j/pom.xml
MD5: 72b71c62a25ec1c934d7b1463fe9790d
SHA1: 66c0601572c4ea1df2aa24e69ff0a7c16a42623b

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | metrics-log4j
pom | groupid | yammer.metrics
pom | name | Metrics Log4j Support
pom | parent-artifactid | metrics-parent
pom | parent-groupid | com.yammer.metrics
pom | version | 2.0.0-RC0

#### Identifiers

- maven: com.yammer.metrics:metrics-log4j:2.0.0-RC0 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/log4j/log4j/pom.xml

Description: Apache Log4j 1.2

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/log4j/log4j/pom.xml
MD5: e15d65d6c97d87704176c1e9338a2adb
SHA1: 88efb1b8d3d993fe339e9e2b201c75eed57d4c65

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | log4j
pom | description | Apache Log4j 1.2
pom | groupid | log4j
pom | name | Apache Log4j
pom | organization name | http://www.apache.org
pom | url | http://logging.apache.org/log4j/1.2/
pom | version | 1.2.16

#### Identifiers

- maven: log4j:log4j:1.2.16 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jersey/pom.xml

Description: A set of class providing Metrics integration for Jersey, the reference JAX- implementation.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jersey/pom.xml
MD5: 0b751b9e702fbd84c41644d71ba55862
SHA1: 8f90c99a87e2e1c67a1056c387bbe3ff1e92f2aa

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | metrics-jersey
pom | description | A set of class providing Metrics integration for Jersey, the reference JAX- implementation.
pom | groupid | yammer.metrics
pom | name | Metrics Jersey Support
pom | parent-artifactid | metrics-parent
pom | parent-groupid | com.yammer.metrics
pom | version | 2.0.0-RC0

#### Identifiers

- maven: com.yammer.metrics:metrics-jersey:2.0.0-RC0 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-annotation/pom.xml

Description: A dependency-less package of just the annotations used by other Metrics modules.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-annotation/pom.xml
MD5: fac7425f6b8789ee45f7a7ad56711af0
SHA1: f28c170c7fbff96de88602d1d11afd9b618e6c59

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | metrics-annotation
pom | description | A dependency-less package of just the annotations used by other Metrics modules.
pom | groupid | yammer.metrics
pom | name | Metrics Annotations
pom | parent-artifactid | metrics-parent
pom | parent-groupid | com.yammer.metrics
pom | version | 2.0.0-RC0

#### Identifiers

- maven: com.yammer.metrics:metrics-annotation:2.0.0-RC0 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-api/pom.xml

Description: The slf4j API

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-api/pom.xml
MD5: d000b772974fbe3ad9e1a68ad8f484e7
SHA1: 93c66c9afd6cf7b91bd4ecf38a60ca48fc5f2078

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | slf4j-api
pom | description | The slf4j API
pom | groupid | slf4j
pom | name | SLF4J API Module
pom | parent-artifactid | slf4j-parent
pom | parent-groupid | org.slf4j
pom | url | http://www.slf4j.org
pom | version | 1.6.4

#### Identifiers

- maven: org.slf4j:slf4j-api:1.6.4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-log4j12/pom.xml

Description: The slf4j log4j-12 binding

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-log4j12/pom.xml
MD5: 228315739fc30a7eb2403bcc8aaca619
SHA1: ab93dfaa2fb9619d91fb31a64bb65802b56ed0fb

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | slf4j-log4j12
pom | description | The slf4j log4j-12 binding
pom | groupid | slf4j
pom | name | SLF4J LOG4J-12 Binding
pom | parent-artifactid | slf4j-parent
pom | parent-groupid | org.slf4j
pom | url | http://www.slf4j.org
pom | version | 1.6.4

#### Identifiers

- maven: org.slf4j:slf4j-log4j12:1.6.4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/jul-to-slf4j/pom.xml

Description: JUL to SLF4J bridge

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/jul-to-slf4j/pom.xml
MD5: ae2b577066d99bea42b1e1f2f0aaf45d
SHA1: bd08211dd5fa0ab44a0a3b04c1ec0c5f67348334

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jul-to-slf4j
pom | description | JUL to SLF4J bridge
pom | groupid | slf4j
pom | name | JUL to SLF4J bridge
pom | parent-artifactid | slf4j-parent
pom | parent-groupid | org.slf4j
pom | url | http://www.slf4j.org
pom | version | 1.6.4

#### Identifiers

- maven: org.slf4j:jul-to-slf4j:1.6.4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-server/pom.xml

Description: The core jetty server artifact.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-server/pom.xml
MD5: 55a7034666834be8a62b8db044ac8d70
SHA1: a9ae16cb473f1797940dd58ed3d5541c88b34396

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-server
pom | description | The core jetty server artifact.
pom | groupid | eclipse.jetty
pom | name | Jetty :: Server Core
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | url | ${jetty.url}
pom | version | 7.6.0.RC4

#### Identifiers

- cpe: cpe:/a:jetty:jetty:7.6.0.rc4 Confidence:LOW
- maven: org.eclipse.jetty:jetty-server:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-continuation/pom.xml

Description: Asynchronous API

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-continuation/pom.xml
MD5: 74919244c9ca106d221f23a832e1076d
SHA1: b59985a1ba1b93fbbd5d90b6ff5ed9f44cc91ac7

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-continuation
pom | description | Asynchronous API
pom | groupid | eclipse.jetty
pom | name | Jetty :: Continuation
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | version | 7.6.0.RC4

#### Identifiers

- cpe: cpe:/a:jetty:jetty:7.6.0.rc4 Confidence:LOW
- maven: org.eclipse.jetty:jetty-continuation:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-servlet/pom.xml

Description: Jetty Servlet Container

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-servlet/pom.xml
MD5: e662a30ea722c442a57a83c478fd7d7e
SHA1: 4a2d357d991aff1ee18e617b7c1076dbcfe89986

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-servlet
pom | description | Jetty Servlet Container
pom | groupid | eclipse.jetty
pom | name | Jetty :: Servlet Handling
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | version | 7.6.0.RC4

#### Identifiers

- cpe: cpe:/a:jetty:jetty:7.6.0.rc4 Confidence:LOW
- maven: org.eclipse.jetty:jetty-servlet:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-security/pom.xml

Description: Jetty security infrastructure

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-security/pom.xml
MD5: 266a3467a1d03bce12e34fda16dfa615
SHA1: 53b54057b58ae7d3c4c12b520b048889a2c28ad8

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-security
pom | description | Jetty security infrastructure
pom | groupid | eclipse.jetty
pom | name | Jetty :: Security
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | version | 7.6.0.RC4

#### Identifiers

- cpe: cpe:/a:jetty:jetty:7.6.0.rc4 Confidence:LOW
- maven: org.eclipse.jetty:jetty-security:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-http/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-http/pom.xml
MD5: f1b6db43b8a499e66ddf58c8165714a5
SHA1: 885e6e766ec3452c085324a9759de5ad8a1c8971

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-http
pom | groupid | eclipse.jetty
pom | name | Jetty :: Http Utility
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | version | 7.6.0.RC4

#### Identifiers

- cpe: cpe:/a:jetty:jetty:7.6.0.rc4 Confidence:LOW
- maven: org.eclipse.jetty:jetty-http:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-io/pom.xml

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-io/pom.xml
MD5: 941c55f8ac0d6c14971d20be7b60ec19
SHA1: f8f0907153f891113bdee011063e540d7d57a496

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-io
pom | groupid | eclipse.jetty
pom | name | Jetty :: IO Utility
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | version | 7.6.0.RC4

#### Identifiers

- maven: org.eclipse.jetty:jetty-io:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-util/pom.xml

Description: Utility classes for Jetty

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-util/pom.xml
MD5: c147343fa7f11c15a5f99ddf8a830b20
SHA1: 9a86a0c493d3834471b7a03e174a9f4d469cbd98

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jetty-util
pom | description | Utility classes for Jetty
pom | groupid | eclipse.jetty
pom | name | Jetty :: Utilities
pom | parent-artifactid | jetty-project
pom | parent-groupid | org.eclipse.jetty
pom | version | 7.6.0.RC4

#### Identifiers

- cpe: cpe:/a:jetty:jetty:7.6.0.rc4 Confidence:LOW
- maven: org.eclipse.jetty:jetty-util:7.6.0.RC4 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.google.guava/guava/pom.xml

Description: Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies. Guava (complete) has only one code dependency - javax.annotation, per the JSR-305 spec.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.google.guava/guava/pom.xml
MD5: 76e749cc3e65c708116326959af90f64
SHA1: b7f1e532b79c7e1c09849c89460798d9a7c59eaf

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | guava
pom | description | Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies. Guava (complete) has only one code dependency - javax.annotation, per the JSR-305 spec.
pom | groupid | google.guava
pom | name | Guava: Google Core Libraries for Java
pom | parent-artifactid | guava-parent
pom | parent-groupid | com.google.guava
pom | version | 11.0.1

#### Identifiers

- maven: com.google.guava:guava:11.0.1 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.hibernate/hibernate-validator/pom.xml

Description: Hibernate's Bean Validation (JSR-303) reference implementation.

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.hibernate/hibernate-validator/pom.xml
MD5: 80f5387c7495664fc4ba31138829b0b8
SHA1: 02ae7dae4450b00f78d8bc458590221e7401eee7

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | hibernate-validator
pom | description | Hibernate's Bean Validation (JSR-303) reference implementation.
pom | groupid | hibernate
pom | name | Hibernate Validator
pom | parent-artifactid | hibernate-validator-parent
pom | parent-groupid | org.hibernate
pom | version | 4.2.0.Final

#### Identifiers

- cpe: cpe:/a:hibernate:hibernate_validator:4.2.0 Confidence:HIGHEST
- maven: org.hibernate:hibernate-validator:4.2.0.Final Confidence:HIGH

#### Published Vulnerabilities

CVE-2014-3558

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

- CONFIRM - https://hibernate.atlassian.net/browse/HV-912
- MISC - https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml
- REDHAT - RHSA-2014:1285
- REDHAT - RHSA-2014:1286
- REDHAT - RHSA-2014:1287
- REDHAT - RHSA-2014:1288
- REDHAT - RHSA-2015:0125
- REDHAT - RHSA-2015:0720

Vulnerable Software & Versions: (show all)

- cpe:/a:hibernate:hibernate_validator:4.2.0
- ...
- cpe:/a:hibernate:hibernate_validator:4.1.0
- cpe:/a:hibernate:hibernate_validator:4.2.0
- cpe:/a:hibernate:hibernate_validator:4.3.0
- cpe:/a:hibernate:hibernate_validator:5.0
- cpe:/a:hibernate:hibernate_validator:5.1

### uber-1.0-SNAPSHOT.jar\META-INF/maven/com.googlecode.jtype/jtype/pom.xml

Description: Library for working with the Java 5 type system

License:

    The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.googlecode.jtype/jtype/pom.xml
MD5: a1dde0cb5b6ebe7e7d3540e0310042ac
SHA1: 2b51d041544482b183c1ae49eba99099d6f14998

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | jtype
pom | description | Library for working with the Java 5 type system
pom | groupid | googlecode.jtype
pom | name | JType
pom | url | http://jtype.googlecode.com/
pom | version | 0.1.1

#### Identifiers

- maven: com.googlecode.jtype:jtype:0.1.1 Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/javax.validation/validation-api/pom.xml

Description: Bean Validation (JSR-303) API.

License:

    Apache License, Version 2.0: license.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/javax.validation/validation-api/pom.xml
MD5: 16476d0cc05b8a4fa53fe1c06383e5dd
SHA1: 257066393db253e1b7ab5f5ee76256615795d08f

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | validation-api
pom | description | Bean Validation (JSR-303) API.
pom | groupid | javax.validation
pom | name | Bean Validation API
pom | version | 1.0.0.GA

#### Identifiers

- maven: javax.validation:validation-api:1.0.0.GA Confidence:HIGH

### uber-1.0-SNAPSHOT.jar\META-INF/maven/org.yaml/snakeyaml/pom.xml

Description: YAML 1.1 parser and emitter for Java

License:

    Apache License Version 2.0: LICENSE.txt

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.yaml/snakeyaml/pom.xml
MD5: 53d95f8de1150f5addaecae68a5dd5cc
SHA1: 6464e4a69d7d79c63a6eb286db777d1e3819c4f7

#### Evidence

Source | Name | Value
--- | --- | ---
pom | artifactid | snakeyaml
pom | description | YAML 1.1 parser and emitter for Java
pom | groupid | yaml
pom | name | SnakeYAML
pom | url | http://www.snakeyaml.org
pom | version | 1.9

#### Identifiers

- maven: org.yaml:snakeyaml:1.9 Confidence:HIGH

### ffmpeg\ffmpeg_version.cmake:libavformat

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\3rdparty\ffmpeg\ffmpeg_version.cmake:libavformat
MD5: 47c336385aec534dee9a316f3ac04773
SHA1: ae482b25e3e5a0d96304d10e7b6d97d18ccac2f6

#### Evidence

Source | Name | Value
--- | --- | ---
ffmpeg\ffmpeg_version.cmake:libavformat | Product | libavformat
ffmpeg\ffmpeg_version.cmake:libavformat | Version | 55.12.100

#### Identifiers

- None

### ffmpeg\ffmpeg_version.cmake:libavutil

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\3rdparty\ffmpeg\ffmpeg_version.cmake:libavutil
MD5: 47c336385aec534dee9a316f3ac04773
SHA1: ea896539e3ef6e4936d8e76060c6479cb094b2fb

#### Evidence

Source | Name | Value
--- | --- | ---
ffmpeg\ffmpeg_version.cmake:libavutil | Product | libavutil
ffmpeg\ffmpeg_version.cmake:libavutil | Version | 52.38.100

#### Identifiers

- None

### ffmpeg\ffmpeg_version.cmake:libswscale

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\3rdparty\ffmpeg\ffmpeg_version.cmake:libswscale
MD5: 47c336385aec534dee9a316f3ac04773
SHA1: 9139f866ffe06bf309a8441cac5c9718962919fe

#### Evidence

Source | Name | Value
--- | --- | ---
ffmpeg\ffmpeg_version.cmake:libswscale | Product | libswscale
ffmpeg\ffmpeg_version.cmake:libswscale | Version | 2.3.100

#### Identifiers

- None

### ffmpeg\ffmpeg_version.cmake:libavresample

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\cmake\opencv\3rdparty\ffmpeg\ffmpeg_version.cmake:libavresample
MD5: 47c336385aec534dee9a316f3ac04773
SHA1: 7df0c82e00e86d400fdb009403f118fbf4bd609f

#### Evidence

Source | Name | Value
--- | --- | ---
ffmpeg\ffmpeg_version.cmake:libavresample | Product | libavresample
ffmpeg\ffmpeg_version.cmake:libavresample | Version | 1.0.1

#### Identifiers

- None

### composer.lock:classpreloader/classpreloader

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:classpreloader/classpreloader
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 46793a86e4afd796833355ad7645974f7cf04229

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | classpreloader
composer.lock | vendor | classpreloader
composer.lock | version | 2.0.0

#### Identifiers

- None

### composer.lock:danielstjules/stringy

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:danielstjules/stringy
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 86d91a8e27a6071f90194a4b94aa7bc96025437f

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | stringy
composer.lock | vendor | danielstjules
composer.lock | version | 1.10.0

#### Identifiers

- None

### composer.lock:dnoegel/php-xdg-base-dir

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:dnoegel/php-xdg-base-dir
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 68be9e876c29b2904ad74f21a27e5151da864e8e

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | php-xdg-base-dir
composer.lock | vendor | dnoegel
composer.lock | version | 0.1

#### Identifiers

- None

### composer.lock:doctrine/inflector

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:doctrine/inflector
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 26a4639d70b9e76f7f480f7d3c68a1e36e169217

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | inflector
composer.lock | vendor | doctrine
composer.lock | version | 1.0.1

#### Identifiers

- None

### composer.lock:jakub-onderka/php-console-color

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:jakub-onderka/php-console-color
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 8865be0ad38837c20a2cf2c6a7c213042455bb62

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | php-console-color
composer.lock | vendor | jakub-onderka
composer.lock | version | 0.1

#### Identifiers

- None

### composer.lock:jakub-onderka/php-console-highlighter

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:jakub-onderka/php-console-highlighter
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: ebec2129dd0621f41111126bf2697903a99c5841

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | php-console-highlighter
composer.lock | vendor | jakub-onderka
composer.lock | version | 0.3.2

#### Identifiers

- None

### composer.lock:jeremeamia/SuperClosure

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:jeremeamia/SuperClosure
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 24557dc330071d84603f4ef882af6a2a9305771b

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | SuperClosure
composer.lock | vendor | jeremeamia
composer.lock | version | 2.1.0

#### Identifiers

- None

### composer.lock:laravel/framework

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:laravel/framework
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: a57e010848bbb7f7dfbace7437a161b8fe048cf6

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | framework
composer.lock | vendor | laravel
composer.lock | version | 5.1.12

#### Identifiers

- None

### composer.lock:laravel/laravel

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:laravel/laravel
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 1d93d6b870d351561fce5a90b9046172420eb7e4

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | laravel
composer.lock | vendor | laravel
composer.lock | version | 5.1.11

#### Identifiers

- None

### composer.lock:league/flysystem

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:league/flysystem
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 63a9d9bd21d69cf18c093eb0fe57f30a323672e2

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | flysystem
composer.lock | vendor | league
composer.lock | version | 1.0.11

#### Identifiers

- None

### composer.lock:monolog/monolog

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:monolog/monolog
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: b0e99548430ffc4272a40663c2eb8e59fbfeda87

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | monolog
composer.lock | vendor | monolog
composer.lock | version | 1.11.0

#### Identifiers

- None

### composer.lock:mtdowling/cron-expression

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:mtdowling/cron-expression
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 3b17d2ae8b30e3cd4c83ebfa95aa5edc1620a32c

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | cron-expression
composer.lock | vendor | mtdowling
composer.lock | version | 1.0.4

#### Identifiers

- None

### composer.lock:nesbot/carbon

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:nesbot/carbon
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 9248633a780786b3a763397b792b2f7c349ca770

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | carbon
composer.lock | vendor | nesbot
composer.lock | version | 1.20.0

#### Identifiers

- None

### composer.lock:nikic/php-parser

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:nikic/php-parser
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: ea900c93fea5fd4ebac7239801adac01d2313bcd

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | php-parser
composer.lock | vendor | nikic
composer.lock | version | 1.4.0

#### Identifiers

- None

### composer.lock:psr/log

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:psr/log
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 4d863dabe431c2908fc9ab54299a7439a43aa76c

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | log
composer.lock | vendor | psr
composer.lock | version | 1.0.0

#### Identifiers

- None

### composer.lock:psy/psysh

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:psy/psysh
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 63af3901e1da6fa356f8086ede860d3fd01bf2b4

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | psysh
composer.lock | vendor | psy
composer.lock | version | 0.5.2

#### Identifiers

- None

### composer.lock:swiftmailer/swiftmailer

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:swiftmailer/swiftmailer
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: fb1c5cdbdea7ba5c129954799200c9921f98aa72

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | swiftmailer
composer.lock | vendor | swiftmailer
composer.lock | version | 5.4.1

#### Identifiers

- None

### composer.lock:symfony/console

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/console
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 23a7232db4e2bae46eb44e77ce583d078d0d8e91

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | console
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/css-selector

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/css-selector
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 4cc0e75ca5f2773f594e7490fbb43e176b0f6be9

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | css-selector
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/debug

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/debug
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: d3f3f153afafcba9083bf0805bf2542e0c6c6c7b

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | debug
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/dom-crawler

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/dom-crawler
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 28aa18b089bd6cf04a10901c0a0649510dd773da

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | dom-crawler
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/event-dispatcher

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/event-dispatcher
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 640703fa46f9ef1ef3195a4c2a62015053328270

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | event-dispatcher
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/finder

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/finder
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 738dcc3213406c287da1449dbace2721df5d8edd

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | finder
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/http-foundation

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/http-foundation
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 25cd052bd3e1f15d0c34d5de85a4fd5022a3c0d9

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | http-foundation
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/http-kernel

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/http-kernel
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 1c48b57b83555de86fb7834381282da2ff7c6d77

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | http-kernel
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/process

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/process
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 6685376d87e56ddfcb013d0cfcb0d6ec9d02cd7e

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | process
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/routing

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/routing
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: d84c27353c5a0ad3c00488a26a9321b105daeb0a

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | routing
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/translation

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/translation
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 6a20965382e221407c72e5eab3235b501460fb8a

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | translation
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:symfony/var-dumper

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:symfony/var-dumper
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: 4f02c9143f31c80ede21311664ffa7fd1486fa92

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | var-dumper
composer.lock | vendor | symfony
composer.lock | version | 2.7.3
hint analyzer | vendor | sensiolabs

#### Identifiers

- None

### composer.lock:vlucas/phpdotenv

File Path: C:\Users\jerem\projects\DependencyCheck\dependency-check-core\target\test-classes\composer.lock:vlucas/phpdotenv
MD5: a4846582d3f217ac97801948bf8c496c
SHA1: dda525c6d1d319b956e10a825e9c4b58285fff02

#### Evidence

Source | Name | Value
--- | --- | ---
composer.lock | product | phpdotenv
composer.lock | vendor | vlucas
composer.lock | version | 1.1.1

#### Identifiers

- None

This report contains data retrieved from the National Vulnerability Database.