Description

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

Remediation

References

CVE-2012-4414

Related Vulnerabilities

WordPress Plugin Bitcoin/AltCoin Payment Gateway for WooCommerce & Multivendor store/shop Cross-Site Scripting (1.6.0)

WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions PHAR Deserialization (2.7.7)

MySQL Numeric Errors Vulnerability (CVE-2006-3486)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5272)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14350)

Severity

Medium

Classification

CVE-2012-4414 CWE-138

Tags

Missing Update Known Vulnerabilities