Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc55-246c-r88f. This link is maintained to preserve external references. Original Description SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged...

Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6wr5-jmpr-mjcx. This link is maintained to preserve external references. Original Description SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing cal...

GHSA-9QJC-Q7HW-VW5R Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6wr5-jmpr-mjcx. This link is maintained to preserve external references. Original Description SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing cal...

GHSA-9QRF-6WHP-92W3 Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc55-246c-r88f. This link is maintained to preserve external references. Original Description SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged...

CVE-2024-58365

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

CVE-2024-58364

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing...

CVE-2024-58361

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error...

EUVD-2024-55684

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...

CVE-2024-58365 SurrealDB before 1.2.0 Denial of Service via Nonexistent Function

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

CVE-2024-58365 SurrealDB before 1.2.0 Denial of Service via Nonexistent Function

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

CVE-2024-58365 SurrealDB before 1.2.0 Denial of Service via Nonexistent Function

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

CVE-2024-58365

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

EUVD-2024-55681

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

CVE-2024-58361

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error...

CVE-2024-58357

CVE-2024-58357 affects SurrealDB versions before 2.1.0. The vulnerability is an uncaught exception in the Rust rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to trigger server panics, causing denia...

CVE-2024-58364: Uncaught Exception

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing...

PT-2026-85347

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6wr5-jmpr-mjcx. This link is maintained to preserve external references. Original Description SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing cal...

CVE-2024-58358: Uncaught Exception

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server...

CVE-2024-58368: Uncaught Exception

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...

Uncaught Exception

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Uncaught Exception through the ExifReader.load. An attacker can cause the application to throw an unhandled exception and terminate the request or worker by submitting a...