CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27925
https://notcve.org/view.php?id=CVE-2021-27925
An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file. Se detectó un problema en Couchbase Server versiones 6.5.x y versiones 6.6.x hasta 6.6.1. Cuando está habilitado el uso de View Engine y Auditing, una condición de bloqueo puede (dependiendo de una condición de carrera) causar a un usuario interno con privilegios de administrador, @ns_server, tener sus credenciales filtradas en texto sin cifrar en el archivo ns_server.info.log • https://www.couchbase.com/downloads https://www.couchbase.com/resources/security#SecurityAlerts • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25644
https://notcve.org/view.php?id=CVE-2021-25644
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators. Se detectó un problema en Couchbase Server versiones 5.x y versiones 6.x hasta 6.6.1 y versión 7.0.0 Beta. Unos comandos incorrectos de la API REST puede resultar que la información de autenticación filtrada sea almacenada en texto sin cifrar en los archivos debug.log e info.log, y también sea mostrado en la Interfaz de Usuario visible para unos administradores • https://www.couchbase.com/downloads https://www.couchbase.com/resources/security#SecurityAlerts • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31158
https://notcve.org/view.php?id=CVE-2021-31158
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access. En el Motor de Consulta en Couchbase Server versiones 6.5.x y versiones 6.6.x hasta 6.6.1, las consultas de Common Table Expression no comprobaban correctamente los permisos del usuario, permitiendo un acceso de lectura a recursos más allá de lo que esos usuarios tenían explícitamente permitido acceder • https://docs.couchbase.com/server/current/release-notes/relnotes.html https://www.couchbase.com/resources/security#SecurityAlerts • CWE-863: Incorrect Authorization •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-25645
https://notcve.org/view.php?id=CVE-2021-25645
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past. Se detectó un problema en Couchbase Server versiones anteriores a 6.0.5, 6.1.x hasta versiones 6.5.x anteriores a 6.5.2 y versiones 6.6.x anteriores a 6.6.1. Un usuario interno con privilegios de administrador, @ns_server, filtra las credenciales en texto sin cifrar en los archivos cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log y stats.log. • https://www.couchbase.com/downloads https://www.couchbase.com/resources/security#SecurityAlerts • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24719
https://notcve.org/view.php?id=CVE-2020-24719
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. • https://www.couchbase.com/resources/security#VulnerabilityReporting • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •