Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: YugabyteDB Component: Yugabytedb Clear all filters
TI-2023-05530 CVE-2023-6002 · GHSA-p56w-h56q-c97x

Log injection in YugabyteDB

Priority LOW 35

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00405 Published 2023-11-07 Fixed in 2.14.14.0, 2.16.8.0 +1 CWE-117
TI-2023-05529 CVE-2023-6001 · GHSA-jj53-4h2j-9gmj

Prometheus Metrics Accessible Pre-Authentication

Priority MEDIUM 40

Prometheus metrics are available without authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00577 Published 2023-11-07 Fixed in 2.18.4.0, 2.20.0.0 CWE-200
TI-2023-04277 CVE-2023-4640 · GHSA-jqrr-cj4q-x8m4

Set Logging Level Without Authentication

Priority LOW 39

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2023-08-30 No fix listed CWE-284
TI-2023-00545 CVE-2023-0575 · GHSA-38h3-jcwf-hx88

Remote code execution in YugabyteDB

Priority MEDIUM 50

External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00776 Published 2023-02-09 Fixed in 2.15 CWE-642