Linux Distros Unpatched Vulnerability : CVE-2022-44010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint usually listening on port 8123 by...

Linux Distros Unpatched Vulnerability : CVE-2024-22412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in...

Linux Distros Unpatched Vulnerability : CVE-2022-44011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user with the ability to load data could cause a heap buffer overflow and crash the...

PT-2025-7940 · Posthog · Posthog

Name of the Vulnerable Software and Affected Versions: PostHog affected versions not specified Description: The issue concerns a SQL injection vulnerability in PostHog's ClickHouse table functions, potentially leading to remote code execution. Recommendations: At the moment, there is no informati...

ClickHouse < 18.10.3

The version of ClickHouse installed on the remote host is prior to 18.10.3. It is, therefore, affected by a remote code execution vulnerability. In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability...

ClickHouse < 1.1.54388

The version of ClickHouse installed on the remote host is prior to 1.1.54388. It is, therefore, affected by a Cross Protocol Request Forgery vulnerability. In ClickHouse before 1.1.54388, remote table function allowed arbitrary symbols in user, password and defaultdatabase fields which led to Cro...

ClickHouse < 19.14.3

The version of ClickHouse installed on the remote host is prior to 19.14.3. It is, therefore, affected by a arbitrary file write vulnerability. In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the...

ClickHouse < 19.13.5.44

The version of ClickHouse installed on the remote host is prior to 19.13.5.44. It is, therefore, affected by a HTTP header injection vulnerability via the url table function. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

ClickHouse < 21.10.2.15 Multiple Vulnerabilities

The version of ClickHouse installed on the remote host is prior to 21.10.2.15. It is, therefore, affected by multiple vulnerabilities. - Heap out-of-bounds read vulnerability in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl loop, a 16-bit...

ClickHouse < 18.12.13

The version of ClickHouse installed on the remote host is prior to 18.12.13. It is, therefore, affected by an arbitrary file read vulnerability, In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages. Note tha...

ClickHouse < 19.14

The version of ClickHouse installed on the remote host is prior to 19.14. It is, therefore, affected by a remote code execution vulnerability. In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via...

ClickHouse < 1.1.54390

The version of ClickHouse installed on the remote host is prior to 1.1.54390. It is, therefore, affected by an arbitrary file read vulnerability. ClickHouse MySQL client before versions 1.1.54390 had LOAD DATA LOCAL INFILE functionality enabled that allowed a malicious MySQL database read arbitra...

ClickHouse < 1.1.54131

The version of ClickHouse installed on the remote host is prior to 1.1.54131. It is, therefore, affected by an access control vulnerability. An Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. Note that Nessus has not tested for...

ClickHouse Detection

Binary data clickhousewebdetect.nbin...

CVE-2022-39267

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With:...

CVE-2024-6873

It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...

CVE-2024-31441

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...

DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked

Buzzy Chinese artificial intelligence AI startup DeepSeek, which has had a meteoric rise in popularity in recent days, left one of its databases exposed on the internet, which could have allowed malicious actors to gain access to sensitive data. The ClickHouse database "allows full control over...

CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

Fixed in ClickHouse v25.1.5.5, 2025-01-05​

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...