CVE-2022-2022: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7...

PT-2022-14443

Name of the Vulnerable Software and Affected Versions nocodb/nocodb versions prior to 0.91.7 Description The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input that contains malicious code, which is then executed by the...

NocoDB 跨站脚本漏洞

NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb into a smart spreadsheet. A security vulnerability exists in NocoDB version 0.91.7, which stems from the presence of a cross-site scripting issue...

Account takeover due to stored XSS in "Project Title"

Description The Project "Title" of the NocoDB application is vulnerable to stored xss which can leads to admin account takeover. Proof of Concept Login with low privileged users and Click on "New Project" then click on "Create" Now write the payload and again click on "Create" Then login from sup...

Information Disclosure

nocodb is vulnerable to information disclosure.The library does not properly sanitize the error message of the password rest when requesting a password reset for a given email address, allowing an attacker to enumerate the registered users email addresses...

CSV Injection

nocodb is vulnerable to CSV injection attacks. The vulnerability exists due to lack of sanitization in table rows which allows attackers to inject payload and execute in endpoint when administer opens the CSV file...

CVE-2022-22121

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...

CVE-2022-22120

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the...

Input validation

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...

Design/Logic Flaw

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the...

CVE-2022-22121

CVE-2022-22121 (NocoDB) affects versions 0.81.0–0.83.8. A low-privileged attacker can create a table and inject payloads into table rows; when an administrator exports data to CSV via the User Management endpoint and opens the file, the payload may execute. Root cause stated as lack of sanitizati...

CVE-2022-22121

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...

CVE-2022-22121 NocoDB - CSV Injection in User Management

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...

CVE-2022-22121 NocoDB - CSV Injection in User Management

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...

CVE-2022-22120

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the...

CVE-2022-22120

CVE-2022-22120 affects NocoDB versions 0.9 to 0.83.8. The vulnerability is an observable discrepancy in the password-reset flow that discloses whether an email is registered, enabling attacker-controlled enumeration of user email addresses. The description in the connected documents aligns on a u...

CVE-2022-22120 NocoDB - Observable Discrepancy in the password-reset feature

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the...

CVE-2022-22120 NocoDB - Observable Discrepancy in the password-reset feature

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the...

PT-2022-15256

Name of the Vulnerable Software and Affected Versions NocoDB versions 0.9 to 0.83.8 Description The issue concerns an Observable Discrepancy in the password-reset feature. When a password reset is requested for a given email address, the application displays an error message if the email is not...

PT-2022-15257

Name of the Vulnerable Software and Affected Versions NocoDB versions 0.81.0 through 0.83.8 Description The issue allows a low privileged attacker to inject payloads into table rows by creating a new table. When an administrator accesses the "User Management endpoint" and exports the data as a CS...