In CartoDB you can find two types of layers: basemaps and user data. Basemap is the layer that you see on the background of the maps and user data layer is the user data displayed on top of it. The data behind these two layers come normally from different places:
Basemaps: We use a variety of different basemaps by default. You should read their attribution information and respect their licenses when using them.
Mapbox Streets: Mapbox produce a basemap using OpenStreetMap and other sources. Read more about them at their website.
Google Maps: We make use of Google Maps V3 to display Google basemaps.
User tileset: On CartoDB interface, the user has the possibility to use external tile sets. The attribution to those tile sets should be state by the user on the interface where it is publishing the map, or using the JS library to do so.
User data: On CartoDB most data comes uploaded by the user. When the user upload data he acknowledged he has the right to do so and should provide attribution information together with the map or as complementary text visible together with the map.
CartoDB is an Open Source project (under a BSD license) and it make use of many different Open Source projects. It is very complicated to describe every single library/project used on the whole stack, so do not consider this a comprehensive list and please check the GitHub page for more information.