security@yugabyte.com
organization01
Rollen
Rollen dieser Identität.
02
Referenzen
Weitere Namen und Kennungen dieser Entität.
nvdUS security@yugabyte.com
03
bewertete Schwachstellen (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-1966US | — | — | ||
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP… | ||||
| CVE-2025-8866US | — | — | ||
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain ser… | ||||
| CVE-2025-8865US | — | — | ||
The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An authenticated attac… | ||||
| CVE-2025-8864US | — | — | ||
Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs | ||||
| CVE-2025-8863US | —OT erhöht | — | ||
YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission | ||||
| CVE-2025-8862US | — | — | ||
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the datab… | ||||
| CVE-2024-11193US | — | — | ||
An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintenti… | ||||
| CVE-2024-11165US | — | — | ||
An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensit… | ||||
| CVE-2024-6908US | — | — | ||
Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unau… | ||||
| CVE-2024-6895US | —OT erhöht | — | ||
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information w… | ||||
| CVE-2024-0006US | — | — | ||
Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially… | ||||
| CVE-2023-6002US | medium6.1 | — | ||
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inj… | ||||
| CVE-2023-6001US | high7.5OT erhöht | — | ||
Prometheus metrics are available without
authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. | ||||
| CVE-2023-4640US | high7.5 | — | ||
The controller responsible for setting the logging level does not include any authorization
checks to ensure the user is authenticated. This can be seen by noting that it extends
C… | ||||
| CVE-2023-0745US | critical9.8 | — | ||
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary
files through the backup upload endpoint by using path trave… | ||||
| CVE-2023-0575US | critical9.8 | — | ||
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (Devops… | ||||
| CVE-2023-0574US | critical9.8 | — | ||
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulner… | ||||
| CVE-2022-37397US | critical9.8 | — | ||
An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is en… | ||||