surrealdb
A scalable, distributed, collaborative, document-graph database, for the realtime web
Security Advisories for surrealdb in cargo
High
about 2 months ago
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
cargo
surrealdb
Moderate
about 2 months ago
SurrealDB allows bypass of deny-net flags via DNS resolution
cargo
SurrealDB
Moderate
3 months ago
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
cargo
surrealdb
Moderate
4 months ago
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
cargo
surrealdb
Moderate
4 months ago
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
cargo
surrealdb
Moderate
4 months ago
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
cargo
surrealdb
Moderate
4 months ago
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
cargo
surrealdb
Moderate
4 months ago
SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
cargo
surrealdb
Moderate
4 months ago
SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
cargo
surrealdb
Moderate
4 months ago
SurrealDB has an Authorization Bypass via Composite Record-id Paths
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
cargo
surrealdb
Moderate
4 months ago
SurrealDB vulnerable to Denial of Service due to nested types annotations
cargo
surrealdb
High
4 months ago
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
cargo
surrealdb
High
4 months ago
SurrealDB has Denial of Service in JSON parser due to nested objects
cargo
surrealdb
High
4 months ago
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
cargo
surrealdb
High
4 months ago
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
cargo
surrealdb
Moderate
4 months ago
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
cargo
surrealdb
High
4 months ago
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
cargo
surrealdb
Moderate
4 months ago
SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
cargo
surrealdb
Moderate
9 months ago
SurrealDB vulnerable to Denial of Service through scripting function memory edge case
cargo
surrealdb
High
9 months ago
SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
cargo
surrealdb
Moderate
about 1 year ago
SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions
cargo
SurrealDB
Moderate
over 1 year ago
SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
cargo
surrealdb
High
over 1 year ago
SurrealDB CPU exhaustion via custom functions result in total DoS
cargo
surrealdb
Low
over 1 year ago
SurrealDB no JavaScript script function default timeout could facilitate DoS
cargo
surrealdb
Critical
over 1 year ago
SurrealDB server-takeover via SurrealQL injection on backup import
cargo
surrealdb
Low
over 1 year ago
SurrealDB has local file read of 2-column TSV files via analyzers
cargo
surrealdb
Moderate
over 1 year ago
SurrealDB vulnerable to memory exhaustion via nested functions and scripts
cargo
surrealdb
High
over 1 year ago
SurrealDB has uncaught exception in Net module that leads to database crash
cargo
surrealdb
Low
almost 2 years ago
SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type
cargo
surrealdb-core, surrealdb
Moderate
almost 2 years ago
SurrealDB has an Uncaught Exception Sorting Tables by Random Order
cargo
surrealdb-core, surrealdb
Moderate
almost 2 years ago
SurrealDB has an Uncaught Exception Handling Nonexistent Role
cargo
surrealdb-core, surrealdb
Moderate
almost 2 years ago
SurrealDB has an Uncaught Exception in Function Generating Random Time
cargo
surrealdb-core, surrealdb
High
about 2 years ago
SurrealDB: Improper Authorization in Select Permissions
cargo
surrealdb-core, surrealdb
High
about 2 years ago
SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings
cargo
surrealdb-core, surrealdb
Moderate
over 2 years ago
SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
cargo
surrealdb-core, surrealdb
Moderate
over 2 years ago
Uncaught Exception in Macro Expecting Native Function to Exist
cargo
surrealdb
Moderate
over 2 years ago
Uncaught Exception Handling Parsing Errors on Line Terminators
cargo
surrealdb
High
almost 3 years ago
SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
cargo
surrealdb