CO
Product
CouchDB
On CISA KEVExploited in the wild
20
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 2Low 0
Watch
Add CouchDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24706 In wildKEV | 9.8 | Apr 26 | Remote Code Execution Vulnerability in Packaging Affected: before 3.2.2 |
| CVE-2020-1955 | 9.8 | May 20 | CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up` Affected: 3.0.0 |
| CVE-2017-12635 | 9.8 | Nov 14 | Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents… Affected: before 1.7.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2018-14889 | 7.8 | Sep 21 | CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability Affected: All versions, or not specified |
| CVE-2016-8742 | 7.8 | Feb 12 | The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation Affected: 2.0.0 |
| CVE-2021-38295 | 7.3 | Oct 14 | In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document Affected: before 3.1.2 |
| CVE-2018-17188 | 7.2 | Jan 2 | Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database Affected: before 2.3.0 |
| CVE-2018-11769 | 7.2 | Aug 8 | CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S) Affected: before 2.2.0 |
| CVE-2018-8007 | 7.2 | Jul 11 | Apache CouchDB administrative users can configure the database server via HTTP(S) Affected: through 1.7.1; 2.0.0 through 2.1.1 |
| CVE-2017-12636 | 7.2 | Nov 14 | CouchDB administrative users can configure the database server via HTTP(S) Affected: before 1.7.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2023-45725 | 5.7 | Dec 13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document Affected: through 3.3.2 |
| CVE-2023-26268 | 5.3 | May 2 | Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * … Affected: before 3.2.3; 3.3.0 before 3.3.2 |
| CVE-2012-5649 | – | May 23 | Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to Adobe Flash Affected: through 1.0.3; 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.1; +1 more |
| CVE-2014-2668 | – | Mar 28 | Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids Affected: through 1.5.0 |
| CVE-2012-5650 | – | Mar 18 | Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web… Affected: through 1.0.3; 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.1; +1 more |
| CVE-2012-5641 | – | Mar 18 | Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x… Affected: through 1.0.3; 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.1; +1 more |
| CVE-2010-3854 | – | Feb 2 | Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject… Affected: 0.8.0; 0.8.1; 0.9.0; 0.9.1; 0.9.2; 0.10.0; +7 more |
| CVE-2010-2953 | – | Sep 14 | Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library… Affected: 0.8.0 |
| CVE-2010-2234 | – | Aug 19 | Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests… Affected: 0.8.0; 0.8.1; 0.9.0; 0.9.1; 0.9.2; 0.10.0; +2 more |
| CVE-2010-0009 | – | Apr 5 | Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords Affected: 0.8.0; 0.8.1; 0.9.0; 0.9.1; 0.9.2; 0.10.0; +1 more |
Showing 20