PT-2023-12929 · Tooljet · Tooljet

Name of the Vulnerable Software and Affected Versions: ToolJet version 1.6.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component. Recommendations: For ToolJet version 1.6.0, consider...

ToolJet 跨站脚本漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. A security vulnerability exists in ToolJet version v1.6.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload...

CVE-2022-27979

ToolJet v1.6.0 contains a cross-site scripting (XSS) vulnerability in the Comment Body component that allows an attacker to inject and execute arbitrary web scripts or HTML. Affected software: ToolJet 1.6.0; vulnerability type: XSS via crafted payload in Comment Body. CVSSv3.1 base score 5.4 (Med...

ToolJet 安全漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. A security vulnerability exists in Tooljet version v1.6.0 that stems from not properly handling missing values in the API. An attacker can exploit the vulnerability to arbitrarily reset a password via a...

PT-2023-12928 · Tooljet · Tooljet

Name of the Vulnerable Software and Affected Versions: Tooljet version 1.6 Description: The issue arises from the improper handling of missing values in the API, allowing attackers to send a crafted HTTP request to arbitrarily reset passwords. Recommendations: For Tooljet version 1.6, consider...

CVE-2022-27979

A cross-site scripting XSS vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component...

CVE-2022-27978

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request...

ToolJet Denial of Service Vulnerability

ToolJet is an extensible, low-code framework for building business applications from ToolJet.A denial-of-service vulnerability exists in ToolJet prior to version 1.27.0, which stems from improper handling of file size limits. An attacker could exploit this vulnerability to cause site downtime...

GHSA-HGP8-W8FJ-R4CM ToolJet is vulnerable to Denial of Service (DoS)

ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0. tooljet is no longer listed on npmjs.com but was listed on npmjs.com in...

ToolJet is vulnerable to Denial of Service (DoS)

ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0. tooljet is no longer listed on npmjs.com but was listed on npmjs.com in...

Design/Logic Flaw

Unrestricted file size limit can lead to DoS in tooljet/tooljet 1.27 by allowing a logged in attacker to upload profile pictures over 2MB...

ToolJet 资源管理错误漏洞

ToolJet is an extensible, low-code framework for building business applications from ToolJet.A denial-of-service vulnerability exists in ToolJet prior to version 1.27.0, which stems from improper handling of file size limits. An attacker could exploit this vulnerability to cause site downtime...

CVE-2022-4111

ToolJet (tooljet/tooljet) versions prior to 1.27.0 are affected by CVE-2022-4111 due to an unrestricted file size limit for user avatar uploads, allowing a logged-in attacker to upload profile pictures over 2MB and cause DoS (site downtime). Root cause: improper handling/validation of file size l...

PT-2022-25662 · Tooljet · Tooljet

Name of the Vulnerable Software and Affected Versions: tooljet/tooljet versions prior to 1.27 Description: The issue allows a logged-in attacker to upload large files, such as profile pictures over 2MB, due to an unrestricted file size limit. This can lead to a denial of service DoS if multiple...

CVE-2022-4111 Improper Validation of Specified Quantity in Input in tooljet/tooljet

Unrestricted file size limit can lead to DoS in tooljet/tooljet 1.27 by allowing a logged in attacker to upload profile pictures over 2MB...

CVE-2022-4111 Improper Validation of Specified Quantity in Input in tooljet/tooljet

Unrestricted file size limit can lead to DoS in tooljet/tooljet 1.27 by allowing a logged in attacker to upload profile pictures over 2MB...

ToolJet 安全漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. ToolJet has a security vulnerability that can be exploited by an attacker to take over access to an account...

CVE-2022-3348 Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim...

ToolJet 信息泄露漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. ToolJet suffers from an information disclosure vulnerability that stems from an attacker being able to steal a different user's account when in the same application as the attacker's editor...

The vulnerability of the getComment() function on the ToolJet application platform allows a violator to elevate their privileges.

The vulnerability of the getComment function on the ToolJet platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...