Couchdb (Apache) - vulnerabilities (CVEs)

20 CVEs, 0 in the last 30 days, 106 known versions, newest CVE from 2023-12-13. Vendor: Apache.

CVEs of Couchdb

CVE-2023-45725 - CVSS 5.7 (medium), 2023-12-13: Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.…
CVE-2023-26268 - CVSS 5.3 (medium), 2023-05-02: Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document…
CVE-2022-24706 - CVSS 9.8 (critical), 2022-04-26: In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The…
CVE-2021-38295 - CVSS 7.3 (high), 2021-10-14: In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin…
CVE-2020-1955 - CVSS 9.8 (critical), 2020-05-20: CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called…
CVE-2018-17188 - CVSS 7.2 (high), 2019-01-02: Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where…
CVE-2018-14889 - CVSS 7.8 (high), 2018-09-21: CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
CVE-2018-11769 - CVSS 7.2 (high), 2018-08-08: CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied…
CVE-2018-8007 - CVSS 7.2 (high), 2018-07-11: Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration…
CVE-2016-8742 - CVSS 7.8 (high), 2018-02-12: The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file…
CVE-2017-12636 - CVSS 7.2 (high), 2017-11-14: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level…
CVE-2017-12635 - CVSS 9.8 (critical), 2017-11-14: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to…
CVE-2012-5649 - CVSS 6.8 (medium), 2014-05-23: Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to…
CVE-2014-2668 - CVSS 5 (medium), 2014-03-28: Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.
CVE-2012-5650 - CVSS 4.3 (medium), 2014-03-18: Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to…
CVE-2012-5641 - CVSS 5 (medium), 2014-03-18: Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x…
CVE-2010-3854 - CVSS 4.3 (medium), 2011-02-02: Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote…
CVE-2010-2953 - CVSS 6.9 (medium), 2010-09-14: Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a…
CVE-2010-2234 - CVSS 6.8 (medium), 2010-08-19: Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators…
CVE-2010-0009 - CVSS 4.3 (medium), 2010-04-05: Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1)…