YYugabyteDB

Products

Exploited and recent CVEs

• CVE-2024-11193 Medium 6.5 An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintentional exposure of sen 0.3%
• CVE-2024-11165 Medium 5.7 An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leak 0.1%
• CVE-2024-6908 Medium 6.0 Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request 0.3%
• CVE-2024-6895 Medium 6.1 Insecure Account Profile Management 0.2%
• CVE-2024-0006 Medium 5.4 DB User Password Leak in Application Log 0.3%
• CVE-2023-6002 Medium 6.5 Log Injection 0.4%
• CVE-2023-6001 Medium 5.3 Prometheus Metrics Accessible Pre-Authentication 0.6%
• CVE-2023-4640 Medium 6.5 Set Logging Level Without Authentication 0.4%
• CVE-2023-0575 High 7.2 Remote Code Execution 0.8%
• CVE-2023-0745 Medium 6.7 Arbitrary File Write in High Availability Backup Upload 0.5%
• CVE-2023-0574 Medium 6.8 Server-Side Request Forgery 0.6%