CVE-2023-6002中 6.1YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivile…
CVE-2023-6001高 7.5Prometheus metrics are available without
authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere envir…
CVE-2023-4640高 7.5The controller responsible for setting the logging level does not include any authorization
checks to ensure the user is authenticated. This…
CVE-2023-0575緊急 9.8External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte …
CVE-2022-37397緊急 9.8An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymo…