743 matches found
ClickHouse < 1.1.54390
The version of ClickHouse installed on the remote host is prior to 1.1.54390. It is, therefore, affected by an arbitrary file read vulnerability. ClickHouse MySQL client before versions 1.1.54390 had LOAD DATA LOCAL INFILE functionality enabled that allowed a malicious MySQL database read arbitra...
ClickHouse < 21.10.2.15 Multiple Vulnerabilities
The version of ClickHouse installed on the remote host is prior to 21.10.2.15. It is, therefore, affected by multiple vulnerabilities. - Heap out-of-bounds read vulnerability in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl loop, a 16-bit...
ClickHouse < 19.14.3
The version of ClickHouse installed on the remote host is prior to 19.14.3. It is, therefore, affected by a arbitrary file write vulnerability. In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the...
ClickHouse < 19.13.5.44
The version of ClickHouse installed on the remote host is prior to 19.13.5.44. It is, therefore, affected by a HTTP header injection vulnerability via the url table function. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
ClickHouse Detection
Binary data clickhousewebdetect.nbin...
CVE-2022-39267
Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With:...
CVE-2024-6873
It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time o...
CVE-2024-31441
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...
DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked
Buzzy Chinese artificial intelligence AI startup DeepSeek, which has had a meteoric rise in popularity in recent days, left one of its databases exposed on the internet, which could have allowed malicious actors to gain access to sensitive data. The ClickHouse database "allows full control over...
Fixed in ClickHouse v25.1.5.5, 2025-01-05
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...
CVE-2025-1385
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...
WS-2021-0497
ClickHouse JDBC Bridge before 2.0.7 uses slf4j-log4j12 1.7.32, which depends on log4j 1.2.17. It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker...
DEBIAN-CVE-2024-41436
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl...
CVE-2024-41436
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl...
UBUNTU-CVE-2024-41436
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl...
ClickHouse 安全漏洞
ClickHouse is a ClickHouse open source one of the fastest and most resource efficient open source databases for real-time applications and analytics. A security vulnerability exists in ClickHouse version v24.3.3.102, which stems from a buffer overflow issue in the DB::evaluateConstantExpressionIm...
PT-2024-29397 · Unknown +1 · Clickhouse +1
Name of the Vulnerable Software and Affected Versions: ClickHouse version 24.3.3.102 Description: A buffer overflow issue was discovered in ClickHouse via the component DB::evaluateConstantExpressionImpl. Recommendations: For ClickHouse version 24.3.3.102, consider disabling the...
CVE-2024-41436
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl...
CVE-2024-41436
ClickHouse version v24.3.3.102 is susceptible to a buffer overflow vulnerability within the DB::evaluateConstantExpressionImpl component. This flaw could lead to significant availability impact , as indicated by the CVSS 3.1 score of 7.5. While specific exploit details are not provided, the vulne...
