CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31158
https://notcve.org/view.php?id=CVE-2021-31158
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access. En el Motor de Consulta en Couchbase Server versiones 6.5.x y versiones 6.6.x hasta 6.6.1, las consultas de Common Table Expression no comprobaban correctamente los permisos del usuario, permitiendo un acceso de lectura a recursos más allá de lo que esos usuarios tenían explícitamente permitido acceder • https://docs.couchbase.com/server/current/release-notes/relnotes.html https://www.couchbase.com/resources/security#SecurityAlerts • CWE-863: Incorrect Authorization •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-25645
https://notcve.org/view.php?id=CVE-2021-25645
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past. Se detectó un problema en Couchbase Server versiones anteriores a 6.0.5, 6.1.x hasta versiones 6.5.x anteriores a 6.5.2 y versiones 6.6.x anteriores a 6.6.1. Un usuario interno con privilegios de administrador, @ns_server, filtra las credenciales en texto sin cifrar en los archivos cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log y stats.log. • https://www.couchbase.com/downloads https://www.couchbase.com/resources/security#SecurityAlerts • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24719
https://notcve.org/view.php?id=CVE-2020-24719
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. • https://www.couchbase.com/resources/security#VulnerabilityReporting • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-9041
https://notcve.org/view.php?id=CVE-2020-9041
In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections. En Couchbase Server versión 6.0.3 y Couchbase Sync Gateway versiones hasta 2.7.0, los endpoints de administración del Clúster, vistas, consultas y búsqueda de texto completo son vulnerables al ataque de denegación de servicio de Slowloris porque no terminan más agresivamente las conexiones lentas • https://www.couchbase.com/resources/security#SecurityAlerts • CWE-404: Improper Resource Shutdown or Release •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-9042
https://notcve.org/view.php?id=CVE-2020-9042
In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request. En Couchbase Server versión 6.0, las credenciales almacenadas en memoria caché por un navegador pueden ser usadas para llevar a cabo un ataque de tipo CSRF si un administrador ha usado su navegador para comprobar los resultados de una petición de la API REST • https://www.couchbase.com/resources/security#SecurityAlerts • CWE-352: Cross-Site Request Forgery (CSRF) •