Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: arangodb Component: Arangodb Clear all filters
TI-2021-07947 CVE-2021-25939 · GHSA-vw3j-xfjf-6rj3

ArangoDB - Blind SSRF when Downloading Foxx Service from URL

Priority LOW 16

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.01129 Published 2022-02-09 No fix listed CWE-918
TI-2021-07946 CVE-2021-25938 · GHSA-fm33-4p7j-3jhr

Cross-site scripting in ArangoDB

Priority LOW 29

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named t…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0081 Published 2021-05-24 No fix listed CWE-79