Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
64 results · page 2 of 2
May 14, 2024NocoDB is software for building databases as spreadsheets.CVE-2023-50717 · Other software · nocodb · reported by GitHubMedium 5.7
NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.
- Product
- nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024NocoDB is software for building databases as spreadsheets.CVE-2023-49781 · Other software · nocodb · reported by GitHubHigh 7.3
NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.
- Product
- nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023Nocodb is an open source Airtable alternative.CVE-2023-43794 · Other software · nocodb · reported by GitHubMedium 6.5
Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates, whether the result of the query execution was true or false. Depending on the result, the HTTP response will be returned after a given number of seconds, indicating TRUE, or immediately, indicating FALSE. In that way, an attacker can reveal the data present in the database. This vulnerability has been addressed in version 0.111.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-141`.
- Product
- nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.CVE-2023-5104 · Other software · nocodb · reported by security@huntr.devMedium 6.5
Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipuCVE-2023-35843 · Other software · Nocodb · reported by MITREHigh 7.5
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
- Product
- Nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.dw1.iogithub.com
Oct 7, 2022Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.CVE-2022-3423 · Other software · nocodb · reported by security@huntr.devHigh 7.3
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents.CVE-2022-2339 · Other software · nocodb · reported by security@huntr.devHigh 7.5
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-2079 · Other software · nocodb · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-2064 · Other software · nocodb · reported by security@huntr.devHigh 8.8
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-2063 · Other software · nocodb · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-2062 · Other software · nocodb · reported by security@huntr.devHigh 7.5
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7.CVE-2022-2022 · Other software · nocodb · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7.
- Product
- nocodb/nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection).CVE-2022-22121 · Other software · nocodb · reported by vulnerabilitylab@mend.ioHigh 8
In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.
- Product
- nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 10, 2022In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature.CVE-2022-22120 · Other software · nocodb · reported by vulnerabilitylab@mend.ioMedium 5.3
In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.
- Product
- nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.