OR
Product
OrientDB
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 4Low 1
Watch
Add OrientDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-11467 | 9.8 | Jul 20 | OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via… Affected: through 2.2.22 |
| CVE-2015-2912 | 8.8 | Dec 31 | The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows… Affected: through 2.0.14; 2.1.0 |
| CVE-2019-25448 | 6.4 | Feb 20 | OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation Affected: 3.0.17 |
| CVE-2019-25449 | 6.1 | Feb 20 | OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint Affected: 3.0.17 |
| CVE-2015-2918 | 6.1 | Dec 31 | The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote… Affected: 2.0.14; 2.1.0 |
| CVE-2015-2913 | 5.9 | Dec 31 | server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the… Affected: 2.0.14; 2.1.0 |
| CVE-2019-25447 | 3.5 | Feb 20 | OrientDB 3.0.17 Cross-Site Request Forgery Affected: 3.0.17 |
Showing 7