CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-11464
https://notcve.org/view.php?id=CVE-2019-11464
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092). Algunas empresas requieren que los puntos finales API REST incluyan encabezados relacionados con la seguridad en las respuestas REST. • https://www.couchbase.com/resources/security#SecurityAlerts • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15728
https://notcve.org/view.php?id=CVE-2018-15728
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2 Couchbase Server expuso el punto final '/ diag / eval' que por defecto está disponible en TCP / 8091 y / o TCP / 18091. Los usuarios autenticados que tienen asignada la función 'Administrador total' pueden enviar código arbitrario de Erlang al punto final 'diag / eval' de la API y el código se ejecutará posteriormente en el sistema operativo subyacente con privilegios del usuario que se utilizó para iniciar Couchbase. • http://seclists.org/bugtraq/2018/Aug/49 http://www.securityfocus.com/bid/105157 https://www.couchbase.com/resources/security#SecurityAlerts • CWE-94: Improper Control of Generation of Code ('Code Injection') •