WS-2017-0152

Affected versions of the foundation-sites package are vulnerable to SQL Injection due to not properly escaping the startkey/endkey in the allDocs function...

WS-2017-0150

Affected versions of the package are vulnerable to SQL Injection due to not properly escaping the startkey/endkey in the allDocs function...

CVE-2019-9039

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

CVE-2019-9039: Improper Neutralization of Special Elements used in an SQL Command

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

PT-2019-19328

Name of the Vulnerable Software and Affected Versions Couchbase Sync Gateway version 2.1.2 Description The issue allows an attacker with access to the Sync Gateway's public REST API to extract sensitive data or call arbitrary N1QL functions through the parameters startkey and endkey on the " all...