Oracle MySQL Workbench vulnerabilities

42 CVEs affecting Oracle MySQL Workbench, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-1292, published 2022-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-10933, published 2018-10-17. Critical severity, CVSS 9.1. EPSS: 91.8% chance of exploitation in the next 30 days. A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in…
CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2020-1967, published 2020-04-21. High severity, CVSS 7.5. EPSS: 53.3% chance of exploitation in the next 30 days. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2021-3518, published 2021-05-18. High severity, CVSS 8.8. EPSS: 21.9% chance of exploitation in the next 30 days. There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The…
CVE-2022-21824, published 2022-02-24. High severity, CVSS 8.2. EPSS: 21.5% chance of exploitation in the next 30 days. Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2021-3517, published 2021-05-19. High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days. There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the…

Latest

CVE-2022-23308, published 2022-02-26. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2021-44533, published 2022-02-24. Medium severity, CVSS 5.3. EPSS: 9.4% chance of exploitation in the next 30 days. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative…
CVE-2021-44532, published 2022-02-24. Medium severity, CVSS 5.3. EPSS: 10.4% chance of exploitation in the next 30 days. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating…
CVE-2021-44531, published 2022-02-24. High severity, CVSS 7.4. EPSS: 8.4% chance of exploitation in the next 30 days. Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9,…
CVE-2021-3634, published 2021-08-31. Medium severity, CVSS 6.5. EPSS: 4.7% chance of exploitation in the next 30 days. A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other…