Yugabyte Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/yugabyte/ Sun, 26 Feb 2023 06:33:14 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Yugabyte Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/yugabyte/ 32 32 CVE-2019-3800 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3800/ Sun, 26 Feb 2023 06:33:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3800/ CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with –client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

The post CVE-2019-3800 appeared first on CVE Vulnerability.

]]> CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with –client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

The post CVE-2019-3800 appeared first on CVE Vulnerability.

]]> CVE-2022-37397 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-37397/ Thu, 23 Feb 2023 05:20:03 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-37397/ An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

The post CVE-2022-37397 appeared first on CVE Vulnerability.

]]> An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

The post CVE-2022-37397 appeared first on CVE Vulnerability.

]]> CVE-2023-0745 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0745/ Wed, 22 Feb 2023 14:02:16 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0745 Relative Path Traversal vulnerability in YugaByte, Inc. Yugabyte Managed (PlatformReplicationManager.Java modules) allows Path Traversal. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects Yugabyte Managed: from 2.0 through 2.13.

The post CVE-2023-0745 appeared first on CVE Vulnerability.

]]> Relative Path Traversal vulnerability in YugaByte, Inc. Yugabyte Managed (PlatformReplicationManager.Java modules) allows Path Traversal. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects Yugabyte Managed: from 2.0 through 2.13.

The post CVE-2023-0745 appeared first on CVE Vulnerability.

]]> CVE-2023-0574 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0574/ Wed, 22 Feb 2023 14:02:15 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0574 Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0 through 2.13.

The post CVE-2023-0574 appeared first on CVE Vulnerability.

]]> Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0 through 2.13.

The post CVE-2023-0574 appeared first on CVE Vulnerability.

]]> CVE-2023-0575 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0575/ Wed, 22 Feb 2023 14:02:15 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0575 External Control of Critical State Data, Improper Control of Generation of Code (‘Code Injection’) vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py. This issue affects Yugabyte DB: Lesser then 2.2.

The post CVE-2023-0575 appeared first on CVE Vulnerability.

]]> External Control of Critical State Data, Improper Control of Generation of Code (‘Code Injection’) vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py. This issue affects Yugabyte DB: Lesser then 2.2.

The post CVE-2023-0575 appeared first on CVE Vulnerability.

]]>