The installed version of MySQL is older than version 3.23.36. Such versions are potentially affected by multiple vulnerabilities :  

  - It is possible to modify arbitrary files and gain     privileges by creating a database with '..' characters.
    (CVE-2001-0407)

  - Users with a MySQL account can use the 'SHOW GRANTS'     command to obtain the encrypted administrator password     from the 'mysql.user' table. (CVE-2001-1275)

  - Local users can modify passwords for arbitrary MySQL     users via the 'GRANT' privilege. (CVE-2000-0045)

One of the sample applications that comes with the Oracle XSQL Servlet  allows an attacker to make arbitrary queries to the Oracle database (under an unprivileged account). Whilst not allowing an attacker to delete or modify database contents, this flaw can be used to enumerate database users and view table names.

The Oracle XSQL Servlet allows arbitrary Java code to be executed by an attacker by supplying the URL of a malicious XSLT stylesheet when making a request to an XSQL page.

It is possible to connect to the remote PostgreSQL database server using an unpassworded account. This may allow an attacker to launch further attacks against the database.

It is possible to connect to the remote MySQL database server using an unpassworded account.  This may allow an attacker to launch further attacks against the database.

The remote version of MySQL is older than (or as old as) version 3.22.30 or 3.23.10.  Thus, it may allow attacker who knows a valid username to access database tables without a valid password.

The remote Microsoft SQL server can be shut down when it is sent a TCP packet containing more than 2 NULLs.

An attacker may use this problem to prevent it from being used by legitimate clients, thus threatening your business.

It was possible to make the remote web server crash by supplying a too long argument to the cgi /ews-bin/fnord. An attacker may use this flaw to prevent your customers to access your website.

ID	Name	Severity
10626	MySQL < 3.23.36 Multiple Vulnerabilities	high
10613	Oracle XSQL query.xsql sql Parameter SQL Injection	medium
10594	Oracle Application Server XSQL Stylesheet Arbitrary Java Code Execution	high
10483	PostgreSQL Default Unpassworded Account	high
10481	MySQL Unpassworded Account Check	high
10343	MySQL Short Check String Authentication Bypass	high
10145	MS99-059: Microsoft SQL Server Crafted TCP Packet Remote DoS (uncredentialed check)	medium
10171	Oracle Webserver PL/SQL Stored Procedure GET Request DoS	medium

Detections

Analytics

Databases Family for Nessus

high

medium

high

high

high

high

medium

medium