Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

20 records in Couchdb · all components

TI-2022-08521 CVE-2022-24706 · GHSA-vxc9-8m8h-9cp6

Remote Code Execution Vulnerability in Packaging

CRITICAL 100KEV

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9251 Published 2022-04-26 No fix listed CWE-1188

TI-2017-09360 CVE-2017-12635 · GHSA-f3p2-qqmm-jg8f

Improper privilege management in Apache CouchDB

CRITICAL 87

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.99838 Published 2017-11-14 No fix listed CWE-269

TI-2017-09361 CVE-2017-12636 · GHSA-fcpq-cj4x-h8mv

OS command injection in Apache CouchDB

HIGH 74

CouchDB administrative users can configure the database server via HTTP(S).

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.90602 Published 2017-11-14 No fix listed CWE-78

TI-2020-01879 CVE-2020-1955 · GHSA-6625-2573-pv96

Missing authentication in Apache CouchDB

MEDIUM 46

CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01846 Published 2020-05-20 No fix listed CWE-306

TI-2018-05784 CVE-2018-8007 · GHSA-mqj2-xj98-r5xp

Improper input validation in Apache CouchDB

MEDIUM 46

Apache CouchDB administrative users can configure the database server via HTTP(S).

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.12164 Published 2018-07-11 Fixed in 1.7.2 CWE-20

TI-2018-08426 CVE-2018-11769 · GHSA-33mm-q6vp-mvmv

CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S).

MEDIUM 43

CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S).

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.08426 Published 2018-08-08 No fix listed

TI-2014-02145 CVE-2014-2668 · GHSA-pgjj-9j9g-vrr7

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service…

MEDIUM 43

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.22687 Published 2014-03-28 No fix listed CWE-20

TI-2012-04750 CVE-2012-5649 · GHSA-w437-cqhg-f7j8

Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote…

LOW 39

Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to Adobe Flash.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.06558 Published 2014-05-23 No fix listed CWE-94

TI-2018-12287 CVE-2018-17188 · GHSA-6c69-f4qc-5997

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key…

LOW 38

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.03613 Published 2019-01-02 No fix listed

TI-2016-07199 CVE-2016-8742 · GHSA-gq4g-cfc7-fgw7

Access control flaw in Apache CouchDB

LOW 38

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.01961 Published 2018-02-12 No fix listed CWE-264

TI-2021-15908 CVE-2021-38295 · GHSA-gr7p-9mx8-wr74

Privilege escalation vulnerability when using HTML attachments

LOW 37

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.02749 Published 2021-10-14 Partial fix · 3.1.2, 8201 CWE-79

TI-2018-10708 CVE-2018-14889 · GHSA-j9pq-3chv-fv8w

CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.

LOW 35

CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00558 Published 2018-09-21 No fix listed CWE-20

TI-2012-04742 CVE-2012-5641 · GHSA-99r9-958v-rr3x

Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in…

LOW 34

Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to r…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08945 Published 2014-03-18 No fix listed CWE-22

TI-2010-02143 CVE-2010-2234 · GHSA-3c6h-p7mj-5m9j

Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0…

LOW 34

Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01833 Published 2010-08-19 No fix listed CWE-352

TI-2010-02826 CVE-2010-2953 · GHSA-3qjx-2c9m-cjpj

Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb…

LOW 31

Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00599 Published 2010-09-14 No fix listed

TI-2010-03661 CVE-2010-3854 · GHSA-wh9m-hj6v-4mg6

Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface…

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vect…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05923 Published 2011-02-02 No fix listed CWE-79

TI-2023-24507 CVE-2023-45725 · GHSA-rmfx-8gmj-c39q

Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents

LOW 28

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01232 Published 2023-12-13 Fixed in 8413 CWE-200

TI-2010-00009 CVE-2010-0009 · GHSA-jwf7-c2x3-76h8

Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive…

LOW 28

Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05332 Published 2010-04-05 No fix listed CWE-200

TI-2023-11430 CVE-2023-26268 · GHSA-97qc-h8j3-mgv9

Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes

LOW 27

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01429 Published 2023-05-02 No fix listed CWE-200

TI-2012-04751 CVE-2012-5650 · GHSA-4324-64fx-mx9p

Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4…

LOW 27

Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameter…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03841 Published 2014-03-18 No fix listed CWE-79

Open these records in search →