Fixed with an update of the affected Perl modules in ST 5.2.1 SP5.

Fixed with an update of the affected Perl modules in ST 5.2.1 SP5.

Fixed with an update of the affected Perl modules in ST 5.2.1 SP5.

Fixed with an update of the affected Perl modules in ST 5.2.1 SP5.

This is not applicable for ST 5.1 as sessionsList.jsp and sessionDetail.jsp are not deployed and thus are not used.

Not vulnerable. Mode SSL_MODE_RELEASE_BUFFERS is not enabled.

This is not applicable for ST as the function PolyFromWKB is not used.

This is not applicable for ST as remote users cannot execute arbitrary code and ST does not execute prepared statements/stored procedures with the described behaviour.

This is not applicable because ST does not use such queries.

This is not applicable for ST as such prepared statements are not used.

This is not applicable for ST as remote users cannot execute arbitrary code.

This is not applicable for ST as remote users cannot execute arbitrary code.

This is not applicable for ST. Remote users cannot execute arbitrary code and ST does not use the described scenario.

This issue is not applicable for ST as users cannot plug in custom applications.

This issue is not applicable for ST.

This is not applicable for ST. Remote users cannot execute EXPLAIN.

This is not applicable for ST as remote users cannot use the HANDLER interface.

This is not applicable for ST as remote users should not be able to execute arbitrary code.

This is not applicable for ST as remote users should not have access to the database.

This is not applicable for ST as the WITH ROLLUP modifier is not used.

This is not applicable for ST as there are no SET columns.

This is not applicable for ST as remote users cannot execute DDL statements.

This is not applicable for ST.

The module mod_proxy_http is not enabled by default by ST but comes as part of the Apache distribution.

This is not applicable for ST. Remote users cannot alter the db tables.

This is not applicable for ST. Remote users cannot execute arbitrary code.

This is not applicable for ST as remote access to the database is not allowed.

This is not applicable for ST because direct access to the database is not allowed.

Not applicable for ST. We use MyISAM only for the table st_version.

This is not applicable for ST 5.1.

This issue is not applicable for ST as mysql and mysql plugins cannot be installed remotely.

This is not applicable for ST. Admin UI does not use basic authentication. When using basic authentication for end user UI the server name and port are not sent.

ST uses multithreaded MPMs only for the Admin ui on Windows. In all other cases are use non-threaded MPMs (the vulnerability is for multithreaded MPMs).

The module mod_isapi is not enabled by default by ST but comes as part of the Apache distribution.

Not applicable for ST. ST comes with neither mod_proxy_ajp nor mod_proxy enabled.