564 matches found
CVE-2023-35843
NocoDB versions through 0.106.0 (or 0.109.1 ) are vulnerable to a path traversal vulnerability in the fileRead() function. An unauthenticated attacker can manipulate the path parameter of the /download route to access arbitrary files on the server. This may lead to the exposure of sensitive data,...
CVE-2023-35843: Improper Limitation of a Pathname to a Restricted Directory
NocoDB through 0.106.0 or 0.109.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the...
NocoDB 路径遍历漏洞
NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb into a smart spreadsheet. A security vulnerability exists in NocoDB version 0.106.0 and earlier versions. An attacker can exploit the vulnerability to access arbitrary files on the server...
CVE-2023-35843
NocoDB through 0.106.0 or 0.109.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the...
CVE-2023-35843
NocoDB through 0.106.0 or 0.109.1 has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the...
NocoDB Resource Management Error Vulnerability
NocoDB is an open source Airtable replacement. A resource management error vulnerability exists in versions of NocoDB prior to 0.92.0, which stems from allowing the insertion of large characters into the input field "New Project" in the creation field. ", an attacker could use this vulnerability ...
GHSA-GRV6-M753-3W2G NocoDB vulnerable to Denial of Service
NocoDB prior to 0.92.0 allows actors to insert large characters into the input field New Project on the create field, which can cause a Denial of Service DoS via a crafted HTTP request. Version 0.92.0 fixes this issue...
NocoDB vulnerable to Denial of Service
NocoDB prior to 0.92.0 allows actors to insert large characters into the input field New Project on the create field, which can cause a Denial of Service DoS via a crafted HTTP request. Version 0.92.0 fixes this issue...
CVE-2022-3423
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...
CVE-2022-3423
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...
Design/Logic Flaw
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...
PT-2022-22086
Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.92.0 Description The issue allows actors to cause a Denial of Service DoS by inserting large characters into the input field New Project on the create field via a crafted HTTP request. Recommendations For versions...
CVE-2022-3423: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0...
CVE-2022-3423
CVE-2022-3423 affects NocoDB prior to version 0.92.0. The issue is a resource management flaw described as Allocation of Resources Without Limits or Throttling, allowing a crafted HTTP request to insert large characters into the input field for creating a new project, which can trigger a Denial o...
CVE-2022-2339 Server-Side Request Forgery (SSRF) in nocodb/nocodb
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information...
NocoDB 代码问题漏洞
NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb into a smart spreadsheet. NocoDB is vulnerable to a code issue. An attacker could exploit the vulnerability to access an internal address in order to make a request as a server and read it...
NocoDB Cross-Site Scripting Vulnerability
NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite, and MariaDb into a smart spreadsheet.A cross-site scripting vulnerability exists in versions of NocoDB prior to 0.91.7, which stems from a lack of data validation filtering of user-supplied data and...
The NocoDB application allows large characters to insert in the input field "New Project" on the create field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request
Proof of Concept Go to http://localhost:8080/dashboard//projects Click on New project and create Fill the "Enter project name" field with huge characters, more than 1 lakh Copy the below payload and put it in the input fields and click on continue. You will see the application accepts large...