Apache

Couchdb

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9

CVE-2017-12636

  • EPSS 93.48%
  • Veröffentlicht 14.11.2017 20:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB bef...

10

CVE-2017-12635

  • EPSS 94.1%
  • Veröffentlicht 14.11.2017 20:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the data...

6.8

CVE-2012-5649

  • EPSS 1.84%
  • Veröffentlicht 23.05.2014 14:55:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to Adobe Flash.

5

CVE-2014-2668

Exploit
  • EPSS 42.92%
  • Veröffentlicht 28.03.2014 16:51:06
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids.

4.3

CVE-2012-5650

  • EPSS 0.9%
  • Veröffentlicht 18.03.2014 17:02:49
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test su...

5

CVE-2012-5641

Exploit
  • EPSS 4.38%
  • Veröffentlicht 18.03.2014 17:02:49
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ ...

4.3

CVE-2010-3854

  • EPSS 3.76%
  • Veröffentlicht 02.02.2011 01:00:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

6.9

CVE-2010-2953

  • EPSS 0.11%
  • Veröffentlicht 14.09.2010 19:00:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory.

6.8

CVE-2010-2234

  • EPSS 0.46%
  • Veröffentlicht 19.08.2010 22:00:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.

4.3

CVE-2010-0009

  • EPSS 0.64%
  • Veröffentlicht 05.04.2010 16:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.