Product:

Couchbase_server

(Couchbase)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 51
Date Id Summary Products Score Patch Annotated
2023-04-14 CVE-2023-2033 Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Couchbase_server, Debian_linux, Fedora, Chrome 8.8
2024-02-29 CVE-2024-23302 Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. Couchbase_server 7.5
2023-06-05 CVE-2023-3079 Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Couchbase_server, Debian_linux, Fedora, Chrome 8.8
2024-01-16 CVE-2024-0519 Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Couchbase_server, Fedora, Chrome 8.8
2020-02-22 CVE-2020-9039 Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to... Couchbase_server 9.8
2020-06-08 CVE-2020-9041 In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections. Couchbase_server, Sync_gateway 7.5
2020-06-08 CVE-2020-9042 In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request. Couchbase_server 8.8
2020-11-12 CVE-2020-24719 Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0. Couchbase_server 9.8
2021-05-10 CVE-2021-25645 An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past. Couchbase_server 4.4
2021-05-19 CVE-2021-25644 An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators. Couchbase_server 7.5