Overview 26 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
26matches
1in Waratek scope3.8%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
3.8%
Outside Waratek scope
0
0.0%
Not applicable
25
96.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
26
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
26
100.0%
split by
peak 7 / year
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20170
20180
20193
Not applicable3
Medium3
not blocked3
No public exploit3
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20215
Not applicable5
Medium5
not blocked5
No public exploit5
20225
Not applicable5
Medium5
not blocked5
No public exploit5
20232
Not applicable2
Medium2
not blocked2
No public exploit2
20247
Not applicable7
Medium7
not blocked7
No public exploit7
20251
Not applicable1
Medium1
not blocked1
No public exploit1
20261
No exploit published1
Medium1
not blocked1
No public exploit1
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-49326 | Medium | 2026-07-24 | No exploit published | No public exploit | Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue. |
| CVE-2024-56178 | Medium | 2025-01-27 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin role. |
| CVE-2024-25673 | Medium | 2024-09-19 | Not applicable | No public exploit | Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection. |
| CVE-2024-37034 | Medium | 2024-07-26 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure. |
| CVE-2023-50436 | Medium | 2024-02-29 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5. |
| CVE-2023-49932 | Medium | 2024-02-29 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions. |
| CVE-2023-45874 | Medium | 2024-02-29 | Not applicable | No public exploit | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads). |
| CVE-2023-43769 | Medium | 2024-02-29 | Not applicable | No public exploit | An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics. |
| CVE-2023-45873 | Medium | 2024-02-28 | Not applicable | No public exploit | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer. |
| CVE-2023-28470 | Medium | 2023-03-23 | Not applicable | No public exploit | In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication. |
| CVE-2022-42950 | Medium | 2023-02-06 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service. |
| CVE-2022-34826 | Medium | 2022-07-15 | Not applicable | No public exploit | In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. |
| CVE-2022-33911 | Medium | 2022-07-12 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information. |
| CVE-2022-32561 | Medium | 2022-06-14 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network. |
| CVE-2022-32193 | Medium | 2022-06-13 | Not applicable | No public exploit | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
| CVE-2021-33504 | Medium | 2022-06-02 | Not applicable | No public exploit | Couchbase Server before 7.1.0 has Incorrect Access Control. |
| CVE-2021-25643 | Medium | 2021-05-26 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call. |
| CVE-2021-31158 | Medium | 2021-05-19 | Not applicable | No public exploit | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access. |
| CVE-2021-27925 | Medium | 2021-05-19 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file. |
| CVE-2021-27924 | Medium | 2021-05-19 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the impersonation of a user if the log files are obtained by an attacker before a session cookie expires. |
| CVE-2021-25645 | Medium | 2021-05-10 | Not applicable | No public exploit | An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past. |
| CVE-2020-26219 | Medium | 2020-11-11 | Not applicable | No public exploit | touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0. |
| CVE-2019-11466 | Medium | 2019-09-10 | Not applicable | No public exploit | In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access. |
| CVE-2019-11465 | Medium | 2019-09-10 | Not applicable | No public exploit | An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted. |
| CVE-2019-11464 | Medium | 2019-09-10 | Not applicable | No public exploit | Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092). |
| CVE-2013-2193 | Medium | 2014-05-29 | Not applicable | No public exploit | Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors. |