An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw res…
An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversi…
Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potent…
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical s…
Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in l…
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to for…
The controller responsible for setting the logging level does not include any authorization
checks to ensure the user is authenticated. This can be seen by not…
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linu…