YugabyteDB vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 20245

Newest CVEs

• CVE-2024-11193

  An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw…

  YugabyteDB · YugabyteDB Anywhere

  Medium5.0
• CVE-2024-11165

  An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This…

  YugabyteDB · YugabyteDB Anywhere

  Medium5.7
• CVE-2024-6908

  Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request

  YugabyteDB · YugabyteDB Anywhere

  Medium6.0
• CVE-2024-6895

  Insecure Account Profile Management

  YugabyteDB · YugabyteDB Anywhere

  Medium6.1
• CVE-2024-0006

  DB User Password Leak in Application Log

  YugabyteDB · YugabyteDB Anywhere

  Medium5.4
• CVE-2023-6002

  Log Injection

  YugabyteDB · YugabyteDB

  Medium6.5
• CVE-2023-6001

  Prometheus Metrics Accessible Pre-Authentication

  YugabyteDB · YugabyteDB Anywhere

  Medium5.3
• CVE-2023-4640

  Set Logging Level Without Authentication

  YugabyteDB · Anywhere

  Medium6.5
• CVE-2023-0575

  Remote Code Execution

  YugabyteDB · YugabyteDB

  High7.2
• CVE-2023-0745

  Arbitrary File Write in High Availability Backup Upload

  YugabyteDB · YugabyteDB Anywhere

  Medium6.7