Apache Couchdb
20 CVEs affecting Apache Couchdb. Latest disclosed: 2023-12-13. Critical: 3, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24706 | Critical | 9.8 | 2022-04-26 | In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The Couch… |
CVE-2020-1955 | Critical | 9.8 | 2020-05-20 | CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_… |
CVE-2017-12635 | Critical | 9.8 | 2017-11-14 | Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to subm… |
CVE-2018-14889 | High | 7.8 | 2018-09-21 | CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability. |
CVE-2016-8742 | High | 7.8 | 2018-02-12 | The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions… |
CVE-2021-38295 | High | 7.3 | 2021-10-14 | In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin ope… |
CVE-2018-17188 | High | 7.2 | 2019-01-02 | Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where… |
CVE-2018-11769 | High | 7.2 | 2018-08-08 | CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration… |
CVE-2018-8007 | High | 7.2 | 2018-07-11 | Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration setti… |
CVE-2017-12636 | High | 7.2 | 2017-11-14 | CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries… |
CVE-2023-45725 | Medium | 5.7 | 2023-12-13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. T… |
CVE-2023-26268 | Medium | 4.4 | 2023-05-02 | Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document fu… |
CVE-2012-5649 | | 2014-05-23 | Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to Adob… | |
CVE-2014-2668 | | 2014-03-28 | Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids. | |
CVE-2012-5650 | | 2014-03-18 | Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to… | |
CVE-2012-5641 | | 2014-03-18 | Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x befor… | |
CVE-2010-3854 | | 2011-02-02 | Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attacker… | |
CVE-2010-2953 | | 2010-09-14 | Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a cra… | |
CVE-2010-2234 | | 2010-08-19 | Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators f… | |
CVE-2010-0009 | | 2010-04-05 | Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hash… |