Total
63 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-23302 | 1 Couchbase | 1 Couchbase Server | 2025-01-16 | N/A | 7.5 HIGH |
| Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. | |||||
| CVE-2024-0519 | 3 Couchbase, Fedoraproject, Google | 3 Couchbase Server, Fedora, Chrome | 2024-12-20 | N/A | 8.8 HIGH |
| Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2023-50782 | 3 Couchbase, Cryptography.io, Redhat | 5 Couchbase Server, Cryptography, Ansible Automation Platform and 2 more | 2024-09-27 | N/A | 7.5 HIGH |
| A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. | |||||
| CVE-2023-36667 | 1 Couchbase | 1 Couchbase Server | 2024-09-04 | N/A | 7.5 HIGH |
| Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. | |||||
| CVE-2023-45875 | 1 Couchbase | 1 Couchbase Server | 2024-09-04 | N/A | 7.5 HIGH |
| An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. | |||||
| CVE-2019-11495 | 1 Couchbase | 1 Couchbase Server | 2024-02-10 | 7.5 HIGH | 9.8 CRITICAL |
| In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remote system. This has been fixed in version 6.0.0. | |||||
| CVE-2022-32557 | 1 Couchbase | 1 Couchbase Server | 2023-08-08 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers. | |||||
| CVE-2022-32559 | 1 Couchbase | 1 Couchbase Server | 2023-08-08 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. | |||||
| CVE-2022-32560 | 1 Couchbase | 1 Couchbase Server | 2023-08-08 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings. | |||||
| CVE-2022-34826 | 1 Couchbase | 1 Couchbase Server | 2023-08-08 | N/A | 5.9 MEDIUM |
| In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. | |||||
| CVE-2021-33504 | 1 Couchbase | 1 Couchbase Server | 2023-08-08 | 4.0 MEDIUM | 4.9 MEDIUM |
| Couchbase Server before 7.1.0 has Incorrect Access Control. | |||||
| CVE-2022-32556 | 1 Couchbase | 1 Couchbase Server | 2022-07-27 | N/A | 7.5 HIGH |
| An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes. | |||||
| CVE-2022-33173 | 1 Couchbase | 1 Couchbase Server | 2022-07-20 | 5.0 MEDIUM | 7.5 HIGH |
| An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead. | |||||
| CVE-2022-33911 | 1 Couchbase | 1 Couchbase Server | 2022-07-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information. | |||||
| CVE-2021-35943 | 1 Couchbase | 1 Couchbase Server | 2022-07-12 | 7.5 HIGH | 9.8 CRITICAL |
| Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513. | |||||
| CVE-2021-27925 | 1 Couchbase | 1 Couchbase Server | 2022-07-12 | 3.5 LOW | 4.4 MEDIUM |
| An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file. | |||||
| CVE-2022-32561 | 1 Couchbase | 1 Couchbase Server | 2022-06-24 | 3.5 LOW | 4.9 MEDIUM |
| An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network. | |||||
| CVE-2022-32564 | 1 Couchbase | 1 Couchbase Server | 2022-06-22 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie. | |||||
| CVE-2022-32192 | 1 Couchbase | 1 Couchbase Server | 2022-06-22 | 5.0 MEDIUM | 7.5 HIGH |
| Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. | |||||
| CVE-2022-32565 | 1 Couchbase | 1 Couchbase Server | 2022-06-22 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids. | |||||