Design/Logic Flaw

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...

PT-2022-22086

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.92.0 Description The issue allows actors to cause a Denial of Service DoS by inserting large characters into the input field New Project on the create field via a crafted HTTP request. Recommendations For versions...

CVE-2022-3423

CVE-2022-3423 affects NocoDB prior to version 0.92.0. The issue is a resource management flaw described as Allocation of Resources Without Limits or Throttling, allowing a crafted HTTP request to insert large characters into the input field for creating a new project, which can trigger a Denial o...

CVE-2022-3423

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...

CVE-2022-3423: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...

CVE-2022-2339 Server-Side Request Forgery (SSRF) in nocodb/nocodb

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information...

NocoDB 代码问题漏洞

NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb into a smart spreadsheet. NocoDB is vulnerable to a code issue. An attacker could exploit the vulnerability to access an internal address in order to make a request as a server and read it...

NocoDB Cross-Site Scripting Vulnerability

NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite, and MariaDb into a smart spreadsheet.A cross-site scripting vulnerability exists in versions of NocoDB prior to 0.91.7, which stems from a lack of data validation filtering of user-supplied data and...

The NocoDB application allows large characters to insert in the input field "New Project" on the create field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

Proof of Concept Go to http://localhost:8080/dashboard//projects Click on New project and create Fill the "Enter project name" field with huge characters, more than 1 lakh Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large...

Cross-site Scripting in NocoDB

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.9...

GHSA-HV6Q-5G4F-8897 Cross-site Scripting in NocoDB

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.9...

CVE-2022-2079

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

CVE-2022-2079

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

CVE-2022-2079 Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

CVE-2022-2079

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

CVE-2022-2079

CVE-2022-2079 corresponds to a stored cross-site scripting vulnerability in NocoDB (nocodb/nocodb) prior to version 0.91.7+. The issue arises from lack of proper data validation/filtering of user-supplied data and its output in the comments feature. Multiple sources (NVD/NVDR, CNVD, Red Hat, OSV,...

CVE-2022-2079 Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

Improper Privilege Management in NocoDB

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.8...

NocoDB information disclosure vulnerability

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents...