couchdb -- multiple vulnerabilities

Apache CouchDB PMC reports: Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases...

Data Pours from Cloud—And ‘The Enemy is Us’

Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...

SSRF, Memcached and other key-value injections in the wild

Back in 2012 we released SSRF a different techniques to exploit Memcached servers and other services with host-based authentication through SSRF. Two years after, in 2014, I presented a Memcached injection techniques at Black Hat USA . There I mentioned that it’s possible to exploit it as a Remot...

'Anonymous' FTP Servers Leaving Healthcare Data Exposed

Hackers craving personal health care information are targeting exposed FTP servers. The FBI issued a warning last week that focused on an increase in criminal activity targeting FTP servers used by medical and dental organizations that are configured to allow anonymous access without...

Hadoop, CouchDB Next Targets in Wave of Database Attacks

Insecure Hadoop and CouchDB installations are the latest targets of cybercriminals who are hijacking and deleting data. Last week, security researchers said 28,000 MongoDB and Elasticsearch installations were hacked in a new wave of attacks against unprotected open source data management platform...

Apache CouchDB Local Privilege Vulnerability

Apache CouchDB is a database of the United States Apache Apache Software Foundation , is a NoSQL database using JSON as a storage format , JavaScript as a query language , MapReduce and HTTP as an API . Apache CouchDB version 2.0.0 suffers from a local lift vulnerability that can be exploited by ...

Apache CouchDB 2.0.0 Local Privilege Escalation

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/APACHE-COUCHDB-LOCAL-PRIVILEGE-ESCALATION.txt + ISR: ApparitionSec Vendor: ================== couchdb.apache.org Product: ============== CouchDB v2.0.0 Apache CouchDB is open...

Apache CouchDB 2.0.0 - Local Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ================== couchdb.apache.org Product: ============== CouchDB v2.0.0 Apache CouchDB is open source database software that focuses on ease of use and having an architecture. It has a...

Apache CouchDB 2.0.0 - Local Privilege Escalation

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/APACHE-COUCHDB-LOCAL-PRIVILEGE-ESCALATION.txt + ISR: ApparitionSec Vendor: ================== couchdb.apache.org Product: ============== CouchDB v2.0.0 Apache CouchDB is open...

Apache CouchDB 2.0.0 - Local Privilege Escalation

Apache CouchDB 2.0.0 - Local Privilege Escalation + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/APACHE-COUCHDB-LOCAL-PRIVILEGE-ESCALATION.txt + ISR: ApparitionSec Vendor: ================== couchdb.apache.org Product:...

Shopify: Open CouchDB on experiments.ec2.shopify.com:5984

A dangling DNS record was pointing to an IP address no longer in our control hosted on Amazon's infrastructure...

CouchDB Unauthorized Access Vulnerability

CouchDB is an open source document-oriented database management system . Can be accessed through the RESTful JavaScript Object Notation JSON API , CouchDB can be installed on most POSIX systems , including Linux and Mac OS X . CouchDB database configuration when there is an unauthorized access...

Use CouchDB to unauthorized access vulnerability to execute arbitrary system commands-bug warning-the black bar safety net

5 on 1 6, Ali cloud shield defense against the team from external sources informed that the CouchDB database exists for unauthorized access vulnerabilities in the configuration is incorrect. After the test, the cloud shield team was the first to discover the use of the unauthorized access...

CouchDB未授权访问导致的任意系统命令执行漏洞

详情来源：阿里云安全 0x01 漏洞的来龙去脉 CouchDB 是一个开源的面向文档的数据库管理系统，可以通过 RESTful JavaScript Object Notation JSON API 访问。CouchDB会默认会在5984端口开放Restful的API接口，用于数据库的管理功能。 那么，问题出在哪呢？翻阅官方描述会发现，CouchDB中有一个QueryServer的配置项，在官方文档中是这么描述的： CouchDB delegates computation of design documents functions to external query servers...

Apache CouchDB Arbitrary Command Execution

CouchDB administrative users can configure the database server via HTTPS. Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitra...

DbDat - Db Database Assessment Tool

DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...

NoSQLMap v0.6 - Automated NoSQL Database Pwnage

NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases, as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to Bernardo Damele and...

Database Assessment Tool: DbDat

DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...

Gentoo Security Advisory GLSA 201412-16

Gentoo Linux Local Security Checks GLSA 201412-16 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Fedora Update for couchdb FEDORA-2014-15967

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...