WS-2017-0152

Affected versions of the foundation-sites package are vulnerable to SQL Injection due to not properly escaping the startkey/endkey in the allDocs function...

CVE-2019-9039

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...