GHSA-GH4H-34GR-87R7 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

MAL-2022-6406 Malicious code in table-dev-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcdd8dcabf6d68b604b5a5624ab59db30fdcec7a788b8d303a6d14ee2b679b30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in table-dev-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcdd8dcabf6d68b604b5a5624ab59db30fdcec7a788b8d303a6d14ee2b679b30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-8MGG-5X65-M4M4 Command Injection in soletta-dev-app

All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call. This may allow attackers to run arbitrary commands in the system. Recommendation ...

Command Injection in soletta-dev-app

All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call. This may allow attackers to run arbitrary commands in the system. Recommendation ...

Command Injection

Overview All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call. This may allow attackers to run arbitrary commands in the system...