Priority CRITICAL 97KEV
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03802 · Published 2024-01-16 · Fixed in 120.0.6099.224 CWE-125
Priority CRITICAL 97KEV
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.37858 · Published 2023-06-05 · Fixed in 114.0.5735.110 CWE-843
Priority CRITICAL 97KEV
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.40648 · Published 2023-04-14 · Fixed in 112.0.5615.121 CWE-843
Priority HIGH 66
A flaw was found in the python-cryptography package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01118 · Published 2024-02-05 · Partial fix · 42.0.0 CWE-203
Priority MEDIUM 62
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.23304 · Published 2020-11-12 · No fix listed CWE-78
Priority MEDIUM 51
An issue was discovered in Couchbase Server before 7.2.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00902 · Published 2024-02-28 · No fix listed CWE-284
Priority MEDIUM 49
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /setti…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03939 · Published 2020-02-22 · No fix listed CWE-276
Priority MEDIUM 46
In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02139 · Published 2019-09-10 · No fix listed CWE-335
Priority MEDIUM 44
An issue was discovered in Couchbase Server before 7.2.x before 7.2.4.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00683 · Published 2024-02-28 · No fix listed CWE-266
Priority MEDIUM 44
An issue was discovered in Couchbase Server before 7.2.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00902 · Published 2024-02-28 · No fix listed CWE-284
Priority MEDIUM 44
Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0107 · Published 2021-09-29 · No fix listed CWE-287
Priority MEDIUM 43
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0288 · Published 2018-08-24 · No fix listed CWE-94
Priority MEDIUM 42
An issue was discovered in Couchbase Server before 7.0.4.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01368 · Published 2022-06-14 · No fix listed CWE-770
Priority MEDIUM 42
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0141 · Published 2019-09-10 · No fix listed CWE-306
Priority MEDIUM 41
Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00998 · Published 2023-11-08 · No fix listed CWE-22
Priority MEDIUM 40
Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00748 · Published 2024-02-28 · No fix listed CWE-200
Priority MEDIUM 40
Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00604 · Published 2024-02-28 · No fix listed CWE-276
Priority MEDIUM 40
An issue was discovered in Couchbase Server 7.2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00736 · Published 2023-11-08 · No fix listed CWE-200
Priority MEDIUM 40
An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00749 · Published 2024-03-27 · No fix listed CWE-770
Priority MEDIUM 40
An issue was discovered in Couchbase Server before 7.0.4.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01001 · Published 2022-06-13 · No fix listed CWE-276
Priority LOW 39
Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00446 · Published 2023-02-06 · No fix listed CWE-319
Priority LOW 39
In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00591 · Published 2020-06-08 · No fix listed CWE-352
Priority LOW 38
An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00657 · Published 2023-02-06 · No fix listed CWE-287
Priority LOW 36
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01344 · Published 2019-09-10 · No fix listed CWE-119
Priority LOW 35
An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01221 · Published 2022-07-11 · No fix listed
Load more
THREATIST.IORead the docs