pkg:crates.io/surrealdb

All known vulnerabilities

• HIGH8.8CVE-2024-58362Untrusted Query Object Evaluation in RPC API
  from 0, < 1.5.5
• HIGH8.8CVE-2023-54366Full Table Permissions by Default
  from 0, < 1.0.1
• HIGH8.5CVE-2024-58366Externally Controlled Format String in Scripting Functions
  from 0, < 1.1.1
• HIGH7.5Uncaught Exception processing HTTP Headers in SurrealDB
  from 0, < 1.1.0
• MEDIUM6.5SurrealDB has an Uncaught Exception Sorting Tables by Random Order
  from 0, < 2.1.0
• MEDIUM6.5SurrealDB has an Uncaught Exception in Function Generating Random Time
  from 0, < 2.1.0
• MEDIUM6.5Improper Authorization in Select Permissions
  from 0, < 2.0.4
• MEDIUM6.5SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings
  >= 2.0.0, < 2.0.4
• MEDIUM6.5Uncaught Exception in Macro Expecting Native Function to Exist
  from 0, < 1.2.0
• MEDIUM6.5Uncaught Exception Handling Parsing Errors on Line Terminators
  from 0, < 1.2.1
• MEDIUM6.5Uncontrolled Recursion in SurrealQL Parsing
  from 0, < 1.1.0
• MEDIUM6.5Uncaught Exception in surrealdb
  from 0, < 1.1.1
• MEDIUM6.3SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
  from 0, < 1.5.4
• MEDIUM5.4SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
  from 0, < 3.1.0
• MEDIUM4.9SurrealDB has an Uncaught Exception Handling Nonexistent Role
  from 0, < 2.1.0
• —SurrealDB vulnerable to Denial of Service through scripting function memory edge case
  from 0, < 2.6.1
• —SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
  from 0, < 2.5.0
• —SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
  >= 2.2.0, < 2.2.2
• —SurrealDB CPU exhaustion via custom functions result in total DoS
  >= 2.2.0, < 2.2.2
• —SurrealDB no JavaScript script function default timeout could facilitate DoS
  >= 2.2.0, < 2.2.2
• —SurrealDB memory exhaustion via string::replace using regex
  >= 2.2.0, < 2.2.2
• —SurrealDB server-takeover via SurrealQL injection on backup import
  >= 2.2.0, < 2.2.2
• —SurrealDB has local file read of 2-column TSV files via analyzers
  >= 2.2.0, < 2.2.2
• —SurrealDB vulnerable to memory exhaustion via nested functions and scripts
  >= 2.2.0, < 2.2.2
• —SurrealDB has uncaught exception in Net module that leads to database crash
  >= 2.2.0, < 2.2.2
• —SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type
  >= 2.0.0, < 2.1.4