Overview 41 matches · 5 in Waratek scope · 0 protected · 4 exploited · 3 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
41matches
5in Waratek scope12.2%
0protected0.0%
4exploited9.8%
3CISA KEV7.3%
3public PoC7.3%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
2.4%
No exploit published
4
9.8%
Outside Waratek scope
0
0.0%
Not applicable
36
87.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
41
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 9 / year
20151
No exploit published1
High1
not blocked1
No public exploit1
20160
20170
20182
No exploit published1
Not applicable1
High2
not blocked2
No public exploit2
20194
No exploit published1
Not applicable3
High4
not blocked4
No public exploit4
20205
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
20215
Not applicable5
High5
not blocked5
No public exploit5
20229
Not applicable9
High9
not blocked9
No public exploit9
20237
Mitigation candidate1
Not applicable6
High7
not blocked7
Exploited3
No public exploit4
20246
Not applicable6
High6
not blocked6
Exploited1
Proof of concept only1
No public exploit4
20251
Not applicable1
High1
not blocked1
No public exploit1
20261
No exploit published1
High1
not blocked1
No public exploit1
201520162017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-46587 | High | 2026-07-06 | No exploit published | No public exploit | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue. |
| CVE-2025-46619 | High | 2025-04-30 | Not applicable | No public exploit | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow. |
| CVE-2023-43768 | High | 2024-03-27 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands. |
| CVE-2024-23302 | High | 2024-02-29 | Not applicable | No public exploit | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. |
| CVE-2023-50437 | High | 2024-02-29 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2. |
| CVE-2023-49338 | High | 2024-02-28 | Not applicable | No public exploit | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. |
| CVE-2023-50782 | High | 2024-02-05 | Not applicable | Proof of concept only | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. |
| CVE-2024-0519 | High | 2024-01-16 | Not applicable | Exploited | Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-45875 | High | 2023-11-08 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. |
| CVE-2023-36667 | High | 2023-11-08 | Not applicable | No public exploit | Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. |
| CVE-2023-36542 | High | 2023-07-29 | Mitigation candidate | Exploited | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation. |
| CVE-2023-3079 | High | 2023-06-05 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-2033 | High | 2023-04-14 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-25016 | High | 2023-02-06 | Not applicable | No public exploit | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. |
| CVE-2022-42951 | High | 2023-02-06 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials. |
| CVE-2022-32556 | High | 2022-07-21 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes. |
| CVE-2022-33173 | High | 2022-07-12 | Not applicable | No public exploit | An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead. |
| CVE-2022-32557 | High | 2022-06-14 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers. |
| CVE-2022-32565 | High | 2022-06-13 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids. |
| CVE-2022-32564 | High | 2022-06-13 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie. |
| CVE-2022-32562 | High | 2022-06-13 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission. |
| CVE-2022-32560 | High | 2022-06-13 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings. |
| CVE-2022-32558 | High | 2022-06-13 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure. |
| CVE-2022-32192 | High | 2022-06-13 | Not applicable | No public exploit | Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
| CVE-2021-42763 | High | 2021-11-02 | Not applicable | No public exploit | Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request. |
| CVE-2021-37842 | High | 2021-11-02 | Not applicable | No public exploit | metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it. |
| CVE-2021-35945 | High | 2021-09-29 | Not applicable | No public exploit | Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. |
| CVE-2021-35944 | High | 2021-09-29 | Not applicable | No public exploit | Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. |
| CVE-2021-25644 | High | 2021-05-19 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators. |
| CVE-2020-26221 | High | 2020-11-11 | Not applicable | No public exploit | touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. The issue is patched in version 2.0. |
| CVE-2020-26218 | High | 2020-11-11 | Not applicable | Working exploit published | touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0. |
| CVE-2020-9042 | High | 2020-06-08 | Not applicable | No public exploit | In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request. |
| CVE-2020-9041 | High | 2020-06-08 | Not applicable | No public exploit | In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections. |
| CVE-2020-9040 | High | 2020-06-08 | Not applicable | No public exploit | Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK's Netty component due to missing hostname verification. |
| CVE-2019-11497 | High | 2019-09-10 | Not applicable | No public exploit | In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate. |
| CVE-2019-11467 | High | 2019-09-10 | Not applicable | No public exploit | In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input. |
| CVE-2019-15544 | High | 2019-08-26 | Not applicable | No public exploit | An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls. |
| CVE-2019-0212 | High | 2019-03-28 | No exploit published | No public exploit | In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server. |
| CVE-2018-15728 | High | 2018-08-24 | Not applicable | No public exploit | Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2 |
| CVE-2018-8025 | High | 2018-06-27 | No exploit published | No public exploit | CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1. |
| CVE-2015-1836 | High | 2015-12-21 | No exploit published | No public exploit | Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic. |