EUVD-2020-23328

Malware in sbrugna...

CVE-2020-35666

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

Sql injection

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id$ne=1 value...

PT-2020-17381

Name of the Vulnerable Software and Affected Versions Steedos Platform versions prior to 1.21.25 Description The issue concerns a NoSQL injection vulnerability. It arises from the mishandling of req.body validation in the /api/collection/findone implementation within server/packages/steedos...