Data Management and Analytics

In Grafana version 11.0.0 and prior a critical severity vulnerability CVE-2024-9264 was detected. The SQL Expressions feature in Grafana allows poorly sanitized duckdb queries with user input, leading to command injection and local file inclusion. Users with VIEWER or higher permissions can exploit this if the duckdb binary is in Grafana’s $PATH. To fix this issue, users need to update to versions 11.0.5, 11.1.6, 11.2.1, 11.0.6, 11.1.7, or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-9264.

In MySQL versions 8.0.39 and prior, 8.4.2 and prior, and 9.0.1 and prior a medium severity vulnerability CVE-2024-21218 was detected. This vulnerability allows attackers with high privileges and network access to cause a MySQL server crash, resulting in a denial of service (DoS). Currently, there’s no patch version for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-21218.

In MySQL versions 8.0.39 and prior, 8.4.2 and prior, 9.0.1 and prior a medium severity vulnerability CVE-2024-21230 was detected. This vulnerability allows attackers with limited privileges to crash the MySQL Server, causing a denial of service (DoS). To fix this problem, users should upgrade to versions 8.0.40, 8.4.3, or 9.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-21230.

In MySQL versions 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior a medium severity vulnerability CVE-2024-21219 was detected. This vulnerability allows high-privileged attackers to crash MySQL Server, causing a denial of service (DoS). To fix this problem, users should upgrade to versions 8.0.40, 8.4.3, or 9.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-21219.

In MySQL versions 8.0.39 and prior, 8.4.2 and prior, and 9.0.1 and prior a medium severity vulnerability CVE-2024-21239 was detected. This vulnerability allows attackers to crash the MySQL server or make it unresponsive, disrupting access to data and services. To fix this issue, users should upgrade MySQL to versions 8.0.40, 8.4.3, or 9.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-21239.

In MySQL versions prior to 8.0.39, prior to 8.4.2, and prior to 9.0.1 a medium severity vulnerability CVE-2024-21238 was detected. This vulnerability allows attackers to cause the MySQL server to freeze or crash, preventing users from accessing their data and services. To fix this issue, users should upgrade MySQL to versions 8.0.40, 8.4.3, or 9.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-21238.

In MySQL versions prior to 8.0.39, prior to 8.4.2, and prior to 9.0.1 a low severity vulnerability CVE-2024-21237 was detected. This vulnerability allows attackers to disrupt some functions of the MySQL server, making it less effective and potentially causing service interruptions. To fix this issue, users should upgrade MySQL to versions 8.0.40, 8.4.3, or 9.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-21237.

In MySQL versions 8.4.2 and prior, and 9.0.1 and prior a low severity vulnerability CVE-2024-21244 was detected. This vulnerability allows attackers with high privileges to gain unauthorized access to sensitive data in MySQL Server through various network protocols. To fix this issue, users should upgrade MySQL to versions 8.4.3 and later, 9.0.2 and later. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-21244.

In MySQL versions 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior a medium severity vulnerability CVE-2024-21241 was detected. This vulnerability in Oracle MySQL’s Server Optimizer allows a high-privileged attacker with network access to cause a denial of service (DoS) by crashing or hanging the MySQL server. Currently there’s no patch version for this vulnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-21241.