yugabyte records

11 published records for vendor yugabyte.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 27.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

11 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-37397No exploit	The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directoryyugabyte · yugabytedb · CWE-16 Pre-auth	Critical9.8	—	0.9%	Aug 12, 2022
39Monitor	CVE-2023-0575No exploit	Remote Code Executionyugabyte · yugabytedb · CWE-94 pre-auth RCE	Critical9.8	—	0.7%	Feb 9, 2023
39Monitor	CVE-2023-0574No exploit	Server-Side Request Forgeryyugabyte · yugabytedb managed · CWE-307 Pre-auth SSRF	Critical9.8	—	0.6%	Feb 9, 2023
39Monitor	CVE-2023-0745No exploit	Arbitrary File Write in High Availability Backup Uploadyugabyte · yugabytedb managed · CWE-23 Pre-auth Path traversal	Critical9.8	—	0.5%	Feb 9, 2023
32Monitor	CVE-2019-3800No exploit	CF CLI writes the client id and secret to config filepivotal · cloud foundry command line interface · CWE-522 Info leak	High7.8	—	2.0%	Aug 5, 2019
30Monitor	CVE-2023-6001No exploit	Prometheus Metrics Accessible Pre-Authenticationyugabyte · yugabytedb · CWE-200 Pre-auth Info leak	High7.5	—	0.5%	Nov 7, 2023
30Monitor	CVE-2024-41435No exploit	YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.yugabyte · yugabytedb · CWE-120 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 3, 2024
30Monitor	CVE-2023-4640No exploit	Set Logging Level Without Authenticationyugabyte · yugabytedb · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High7.5	—	0.3%	Aug 30, 2023
24Monitor	CVE-2023-6002No exploit	YugabyteDB is vulnerable to cross site scripting (XSS) via log injection.yugabyte · yugabytedb · CWE-117 Pre-auth XSS	Medium6.1	—	0.4%	Nov 7, 2023
24Monitor	CVE-2024-6895No exploit	Insecure Account Profile Managementyugabytedb · yugabytedb anywhere · CWE-306 Auth bypass	Medium6.1	—	0.2%	Jul 19, 2024
21Monitor	CVE-2024-0006No exploit	DB User Password Leak in Application Logyugabytedb · yugabytedb anywhere · CWE-532 Info leak	Medium5.4	—	0.2%	Jul 19, 2024

CVE-2022-37397
39Monitor
The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
yugabyte · yugabytedbAug 12, 2022
CVE-2023-0575
39Monitor
Remote Code Execution
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
yugabyte · yugabytedbFeb 9, 2023
CVE-2023-0574
39Monitor
Server-Side Request Forgery
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SSRF
yugabyte · yugabytedb managedFeb 9, 2023
CVE-2023-0745
39Monitor
Arbitrary File Write in High Availability Backup Upload
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
yugabyte · yugabytedb managedFeb 9, 2023
CVE-2019-3800
32Monitor
CF CLI writes the client id and secret to config file
HighCVSS 7.8No exploitEPSS 2%
- Info leak
pivotal · cloud foundry command line interfaceAug 5, 2019
CVE-2023-6001
30Monitor
Prometheus Metrics Accessible Pre-Authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
yugabyte · yugabytedbNov 7, 2023
CVE-2024-41435
30Monitor
YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.
HighCVSS 7.5No exploitEPSS 0%
yugabyte · yugabytedbSep 3, 2024
CVE-2023-4640
30Monitor
Set Logging Level Without Authentication
HighCVSS 7.5No exploitEPSS 0%
yugabyte · yugabytedbAug 30, 2023
CVE-2023-6002
24Monitor
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
yugabyte · yugabytedbNov 7, 2023
CVE-2024-6895
24Monitor
Insecure Account Profile Management
MediumCVSS 6.1No exploitEPSS 0%
- Auth bypass
yugabytedb · yugabytedb anywhereJul 19, 2024
CVE-2024-0006
21Monitor
DB User Password Leak in Application Log
MediumCVSS 5.4No exploitEPSS 0%
- Info leak
yugabytedb · yugabytedb anywhereJul 19, 2024