YugabyteDB

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

YugabyteDB records in CISA KEV

No YugabyteDB vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

6 records in Yugabytedb · all components

TI-2024-27623 CVE-2024-41435 · GHSA-2qqq-gmvr-p2rw

HIGH 72

YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0051 Published 2024-09-03 No fix listed CWE-120

TI-2023-00545 CVE-2023-0575 · GHSA-38h3-jcwf-hx88

MEDIUM 50

External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00776 Published 2023-02-09 Fixed in 2.15 CWE-642

TI-2022-17471 CVE-2022-37397 · GHSA-3r4j-8whf-548p

MEDIUM 44

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00935 Published 2022-08-12 No fix listed CWE-16

TI-2023-05529 CVE-2023-6001 · GHSA-jj53-4h2j-9gmj

MEDIUM 40

Prometheus metrics are available without authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00577 Published 2023-11-07 Fixed in 2.18.4.0, 2.20.0.0 CWE-200

TI-2023-04277 CVE-2023-4640 · GHSA-jqrr-cj4q-x8m4

LOW 39

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2023-08-30 No fix listed CWE-284

TI-2023-05530 CVE-2023-6002 · GHSA-p56w-h56q-c97x

LOW 35

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00405 Published 2023-11-07 Fixed in 2.14.14.0, 2.16.8.0 +1 CWE-117