SurrealDB
A scalable, distributed, collaborative, document-graph database, for the realtime web
Security Advisories for SurrealDB in cargo
Moderate
1 day ago
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB has an Authorization Bypass via Composite Record-id Paths
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Graph traversal bypasses table SELECT permissions
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB vulnerable to Denial of Service due to nested types annotations
cargo
surrealdb
High
about 2 months ago
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
cargo
surrealdb
High
about 2 months ago
SurrealDB has Denial of Service in JSON parser due to nested objects
cargo
surrealdb
High
about 2 months ago
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
cargo
surrealdb
High
about 2 months ago
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
cargo
surrealdb
High
about 2 months ago
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
cargo
surrealdb
Moderate
6 months ago
SurrealDB vulnerable to Denial of Service through scripting function memory edge case
cargo
surrealdb
High
7 months ago
SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
cargo
surrealdb
Moderate
11 months ago
SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions
cargo
SurrealDB
Moderate
over 1 year ago
SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
cargo
surrealdb
High
over 1 year ago
SurrealDB CPU exhaustion via custom functions result in total DoS
cargo
surrealdb
Low
over 1 year ago
SurrealDB no JavaScript script function default timeout could facilitate DoS
cargo
surrealdb
Critical
over 1 year ago
SurrealDB server-takeover via SurrealQL injection on backup import
cargo
surrealdb
Low
over 1 year ago
SurrealDB has local file read of 2-column TSV files via analyzers
cargo
surrealdb
Moderate
over 1 year ago
SurrealDB vulnerable to memory exhaustion via nested functions and scripts
cargo
surrealdb
High
over 1 year ago
SurrealDB has uncaught exception in Net module that leads to database crash
cargo
surrealdb
Low
over 1 year ago
SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type
cargo
surrealdb-core, surrealdb
Moderate
over 1 year ago
SurrealDB has an Uncaught Exception Sorting Tables by Random Order
cargo
surrealdb-core, surrealdb
Moderate
over 1 year ago
SurrealDB has an Uncaught Exception Handling Nonexistent Role
cargo
surrealdb-core, surrealdb
Moderate
over 1 year ago
SurrealDB has an Uncaught Exception in Function Generating Random Time
cargo
surrealdb-core, surrealdb
High
almost 2 years ago
Improper Authorization in Select Permissions
cargo
surrealdb-core, surrealdb
High
almost 2 years ago
SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings
cargo
surrealdb-core, surrealdb
High
almost 2 years ago
Untrusted Query Object Evaluation in RPC API
cargo
surrealdb, surrealdb-core
Moderate
about 2 years ago
SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
cargo
surrealdb-core, surrealdb
Moderate
over 2 years ago
Uncaught Exception in Macro Expecting Native Function to Exist
cargo
surrealdb
Moderate
over 2 years ago
Uncaught Exception Handling Parsing Errors on Line Terminators
cargo
surrealdb
High
over 2 years ago
SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
cargo
surrealdb