https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 01:53:28 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-15060 cnvd-2018-15060 https://cve.radiocsirt.org/vuln/cnvd-2018-15060 https://cve.radiocsirt.org/vuln/euvd-2026-167069 EUVD-2026-167069 https://cve.radiocsirt.org/vuln/euvd-2026-167069 https://cve.radiocsirt.org/vuln/fkie_cve-2018-11769 <p>CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system&#39;s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.</p> <p>CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system&#39;s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-11769 https://cve.radiocsirt.org/vuln/ghsa-33mm-q6vp-mvmv <p>CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system&#39;s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.</p> <p>CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system&#39;s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.</p> https://cve.radiocsirt.org/vuln/ghsa-33mm-q6vp-mvmv https://cve.radiocsirt.org/vuln/gsd-2018-11769 gsd-2018-11769 https://cve.radiocsirt.org/vuln/gsd-2018-11769 https://cve.radiocsirt.org/vuln/suse-su-2019:0392-1 <p>Security update for couchdb</p> <p>Security update for couchdb</p> https://cve.radiocsirt.org/vuln/suse-su-2019:0392-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-11769 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: couchdb</p> <p>CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system&#39;s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: couchdb</p> <p>CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system&#39;s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-11769