15 matches found
CVE-2026-59164
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...
CVE-2026-59164 NORA missing cross-user token-management authorization
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...
CVE-2026-59164
The NORA self-hosted artifact registry (versions prior to 0.9.5 ) contains a missing authorization vulnerability in the nora-registry component. While the auth_middleware() protects the token-management UI, it fails to enforce administrator authorization for state-changing requests, checking only...
EUVD-2026-112076
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...
PT-2026-128248
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can...
CVE-2024-30564
An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...
MAL-2024-2128 Malicious code in down_load_ebook_alpha_by_nora_ash_cwtto (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-30564
An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...
Nora-common security vulnerabilities
nora-common is a common repo between the NORA Node Red client and the NORA Firebase backend by Andrei Tatar Individual Developer. A security vulnerability exists in nora-common versions v.1.0.41 through v.1.12.2, which originates from a vulnerability that allows remote attackers to execute...
CVE-2024-30564: Improperly Controlled Modification of Object Prototype Attributes
An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...
CVE-2024-30564
The @andrei-tatar/nora-firebase-common library (versions v.1.0.41 through v.1.12.2 ) is vulnerable to a Prototype Pollution flaw (CWE-1321). The root cause is the improper handling of the updateState parameter within the updateStateInternal method. A remote attacker can exploit this by providing ...
PT-2024-23492 · Unknown · Inandrei-Tatar Nora-Firebase-Common
Name of the Vulnerable Software and Affected Versions: inandrei-tatar nora-firebase-common versions 1.0.41 through 1.12.2 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method. This enables the...
CVE-2024-30564
An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...
nora-advanced.de Cross Site Scripting vulnerability OBB-2707262
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
nora-auto.dk Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1177392 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...