Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

60 results · page 1 of 2

Apr 30, 2025A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensiCVE-2025-46619 · Other software · Couchbase · reported by MITREHigh 7.6
A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jan 27, 2025An issue was discovered in Couchbase Server 7.6.x through 7.6.3.CVE-2024-56178 · Other software · Couchbase · reported by MITREMedium 6.5
An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin role.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com
Sep 19, 2024Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.CVE-2024-25673 · Other software · Couchbase · reported by MITREMedium 6.1
Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 26, 2024An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1.CVE-2024-37034 · Other software · Couchbase · reported by MITREMedium 5.9
An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Mar 27, 2024An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1.CVE-2023-43768 · Other software · couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.CVE-2024-23302 · Other software · couchbase · reported by MITREHigh 7.5
Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.x before 7.2.4.CVE-2023-50437 · Other software · couchbase · reported by MITREHigh 8.6
An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-50436 · Other software · Couchbase · reported by MITREMedium 5.3
An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-49932 · Other software · Couchbase · reported by MITREMedium 5.4
An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-49931 · Other software · couchbase · reported by MITRECritical 9.8
An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-49930 · Other software · Couchbase · reported by MITRECritical 9.8
An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server through 7.2.2.CVE-2023-45874 · Other software · Couchbase · reported by MITREMedium 4.3
An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads).
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1.CVE-2023-43769 · Other software · Couchbase · reported by MITREMedium 6.3
An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.CVE-2023-49338 · Other software · couchbase · reported by MITREHigh 7.5
Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.
Product
server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server through 7.2.2.CVE-2023-45873 · Other software · Couchbase · reported by MITREMedium 6.5
An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Nov 8, 2023Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.CVE-2023-36667 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Nov 8, 2023An issue was discovered in Couchbase Server 7.2.0.CVE-2023-45875 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Mar 22, 2023In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.CVE-2023-28470 · Other software · Couchbase · reported by MITREMedium 5.3
In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 6, 2023Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.CVE-2023-25016 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 6, 2023An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2.CVE-2022-42951 · Other software · Couchbase · reported by MITREHigh 8.1
An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 6, 2023An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2.CVE-2022-42950 · Other software · Couchbase · reported by MITREMedium 4.9
An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 21, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32556 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 15, 2022In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.CVE-2022-34826 · Other software · Couchbase · reported by MITREMedium 5.9
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Jul 12, 2022An issue was discovered in Couchbase Server 7.x before 7.0.4.CVE-2022-33911 · Other software · Couchbase · reported by MITREMedium 5.3
An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 12, 2022An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4.CVE-2022-33173 · Other software · Couchbase · reported by MITREHigh 7.5
An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 14, 2022An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4.CVE-2022-32561 · Other software · Couchbase · reported by MITREMedium 4.9
An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 14, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32559 · Other software · Couchbase · reported by MITRECritical 9.1
An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 14, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32557 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 13, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32565 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 13, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32562 · Other software · Couchbase · reported by MITREHigh 8.8
An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 13, 2022Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.CVE-2022-32192 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Jun 13, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32564 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 13, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32560 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 13, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32558 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 13, 2022Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.CVE-2022-32193 · Other software · Couchbase · reported by MITREMedium 6.5
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Jun 2, 2022Couchbase Server before 7.1.0 has Incorrect Access Control.CVE-2021-33504 · Other software · Couchbase · reported by MITREMedium 4.9
Couchbase Server before 7.1.0 has Incorrect Access Control.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Nov 2, 2021Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext.CVE-2021-42763 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Nov 2, 2021metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information.CVE-2021-37842 · Other software · Couchbase · reported by MITREHigh 7.5
metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Sep 29, 2021Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow.CVE-2021-35945 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Sep 29, 2021Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow.CVE-2021-35944 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Sep 29, 2021Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control.CVE-2021-35943 · Other software · Couchbase · reported by MITRECritical 9.8
Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
May 26, 2021An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2.CVE-2021-25643 · Other software · Couchbase · reported by MITREMedium 4.9
An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
May 19, 2021An issue was discovered in Couchbase Server 6.x through 6.6.1.CVE-2021-27924 · Other software · Couchbase · reported by MITREMedium 5.9
An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the impersonation of a user if the log files are obtained by an attacker before a session cookie expires.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
May 19, 2021In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowCVE-2021-31158 · Other software · Couchbase · reported by MITREMedium 6.5
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
May 19, 2021An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1.CVE-2021-27925 · Other software · Couchbase · reported by MITREMedium 4.4
An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
May 19, 2021An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta.CVE-2021-25644 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
May 10, 2021An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1.CVE-2021-25645 · Other software · Couchbase · reported by MITREMedium 4.4
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Nov 12, 2020Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack.CVE-2020-24719 · Other software · Couchbase · reported by MITRECritical 9.8
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Jun 8, 2020In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results ofCVE-2020-9042 · Other software · Couchbase · reported by MITREHigh 8.8
In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Jun 8, 2020In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the SCVE-2020-9041 · Other software · Couchbase · reported by MITREHigh 7.5
In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.