PT-2024-29396 · Yugabyte · Yugabytedb

Name of the Vulnerable Software and Affected Versions: YugabyteDB version 2.21.1.0 Description: A buffer overflow issue was discovered in YugabyteDB via the insert into parameter. Recommendations: For YugabyteDB version 2.21.1.0, consider restricting the use of the insert into parameter until a...

CVE-2024-41435

YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter...

CVE-2024-41435

YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter...

CVE-2024-41435

YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter...

CVE-2024-41435

CVE-2024-41435 affects YugabyteDB v2.21.1.0, with a buffer overflow in the insert into parameter. Multiple sources confirm the issue and classify the impact as high (CVSSv3.1: 7.5, Network attack vector, no privileges or user interaction required; availability impact is High). Red Hat and PT-Se...

CVE-2023-6002

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6001

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

Cross site scripting

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6002 Log Injection

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6002

YugabyteDB is affected by CVE-2023-6002: a cross-site scripting (XSS) vulnerability via log injection. The issue arises when invalidated user input is written to log files, which can allow an unprivileged attacker to forge log entries or inject malicious content into logs. The provided documents ...

CVE-2023-6002 Log Injection

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6002 Log Injection

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-6001

Prometheus metrics are accessible without authentication in YugabyteDB Anywhere (CVE-2023-6001). Affected component is Prometheus metrics exposure within YugabyteDB Anywhere, leading to potential exposure of sensitive environment information. Documented impact includes high confidentiality impact...

YugabyteDB Cross-Site Scripting Vulnerability

YugabyteDB is a high-performance transactional distributed SQL database for cloud-native applications from Yugabyte, Inc. YugabyteDB suffers from a cross-site scripting vulnerability that stems from the ease of injecting cross-site scripting via logs, where writing invalid user input to a log fil...

PT-2023-32468 · Yugabyte · Yugabytedb Anywhere

Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere affected versions not specified Description: The issue concerns Prometheus metrics being available without authentication, exposing detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-4640

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere:...

Authorization

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere:...