Apache CouchDB UUID远程拒绝服务漏洞

Bugtraq ID:66474 Apache Software Foundation CouchDB是一款源的面向文档的数据库管理系统。 Apache CouchDB处理/uuids HTTP请求存在错误，允许攻击者利用漏洞发送特制的"count"参数，消耗大量CPU和内存资源，造成拒绝服务攻击。 0 Apache CouchDB 1.5.0 目前没有详细解决方案提供： http://couchdb.apache.org/ curl...

CVE-2014-2668

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service CPU and memory consumption via the count parameter to /uuids...

Code injection

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service CPU and memory consumption via the count parameter to /uuids...

CVE-2014-2668

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service CPU and memory consumption via the count parameter to /uuids...

CVE-2014-2668

CVE-2014-2668 affects Apache CouchDB 1.5.0 and earlier. A remote attacker could trigger a Denial of Service by abusing the count parameter to /_uuids, consuming CPU and memory. Public advisories and OpenVAS/Gentoo entries consistently describe the issue and recommend upgrading to a newer CouchDB ...

CVE-2014-2668

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service CPU and memory consumption via the count parameter to /uuids...

Couchdb 1.5.0 - uuids Denial of Service Vulnerability

Exploit for multiple platform in category dos / poc Exploit Title: Couchdb uuids DOS exploit Google Dork inurl: uuids Date: 03/24/2014 Exploit Author: KrustyHack Vendor Homepage: http://couchdb.apache.org/ Software Link: http://couchdb.apache.org/ Version: up to 1.5.0 Tested on: Linux Couchdb up ...

CouchDB UUIDS Denial Of Service

Exploit Title: Couchdb uuids DOS exploit Google Dork inurl: uuids Date: 03/24/2014 Exploit Author: KrustyHack Vendor Homepage: http://couchdb.apache.org/ Software Link: http://couchdb.apache.org/ Version: up to 1.5.0 Tested on: Linux Couchdb up to 1.5.0 HOW TO ====== curl...

Apache CouchDB 1.5.0 - uuids Denial of Service

Apache CouchDB 1.5.0 - uuids Denial of Service Exploit Title: Couchdb uuids DOS exploit Google Dork inurl: uuids Date: 03/24/2014 Exploit Author: KrustyHack Vendor Homepage: http://couchdb.apache.org/ Software Link: http://couchdb.apache.org/ Version: up to 1.5.0 Tested on: Linux Couchdb up to...

Apache CouchDB 1.5.0 - 'uuids' Denial of Service

Exploit Title: Couchdb uuids DOS exploit Google Dork inurl: uuids Date: 03/24/2014 Exploit Author: KrustyHack Vendor Homepage: http://couchdb.apache.org/ Software Link: http://couchdb.apache.org/ Version: up to 1.5.0 Tested on: Linux Couchdb up to 1.5.0 HOW TO ====== curl...

CVE-2012-5650

Cross-site scripting XSS vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite...

CVE-2012-5650

Cross-site scripting XSS vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite...

Cross site scripting

Cross-site scripting XSS vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite...

Directory traversal

Directory traversal vulnerability in the partition2 function in mochiwebutil.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the default URI...

CVE-2012-5650

Cross-site scripting XSS vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite...

CVE-2012-5641

CVE-2012-5641 describes a directory traversal in MochiWeb (partition2 in mochiweb_util.erl) that could let remote attackers read arbitrary files via ..\ in the default URI. Affected: MochiWeb prior to 2.4.0 used in Apache CouchDB prior to 1.0.4, 1.1.x prior to 1.1.2, and 1.2.x prior to 1.2.1. Imp...

CVE-2012-5650

The CVE-2012-5650 entry describes a Cross-Site Scripting (XSS) vulnerability in the Futon UI of Apache CouchDB. AFFECTED VERSIONS include CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified para...

Automated NoSQL Database Injection Attacks: NoSQLMap

NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to Bernardo Damele and...

[SECURITY] Fedora 18 Update: nodejs-couch-login-0.1.17-1.fc18

A module for doing logged-in requests to a couchdb server...

FreeBSD : couchdb -- DOM based XSS via Futon UI (4fb45a1c-c5d0-11e2-8400-001b216147b0)

Jan Lehnardt reports : Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...