CVE-2023-30591 NodeBB Pre-Authentication Denial-of-Service

Denial-of-service in NodeBB = v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively...

CVE-2023-30591

NodeBB pre-2.8.11 is affected by a Denial-of-Service flaw in how Socket.IO messages are processed. The issue arises when eventName is an array or object and the code calls eventName.startsWith() or eventName.toString() without sufficient validation, causing crashes. Affected software: NodeBB 2.8...

CVE-2023-30591 NodeBB Pre-Authentication Denial-of-Service

Denial-of-service in NodeBB = v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively...

NodeBB Code Issues Vulnerabilities

NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A code issue vulnerability exists in NodeBB v2.8.10 and earlier versions. An attacker exploited the vulnerability to cause the system to crash...

PT-2023-22800 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions = 2.8.10 Description: The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages...

NodeBB 2.5.x < 2.8.7 Path Traversal Vulnerability

NodeBB is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodebb:nodebb"; ifdescription...

NodeBB < 2.6.1 Account Takeover Vulnerability

NodeBB is prone to an account takeover vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodebb:nodebb"; ifdescripti...

NodeBB 2.x < 2.8.13, 3.x < 3.1.3 Information Disclosure Vulnerability

NodeBB is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodebb:nodebb";...

CVE-2023-43187

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

CVE-2023-43187

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

Remote code execution

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

NodeBB Security Vulnerabilities

NodeBB is a forum system built using Node.js a web application platform built on top of Google's V8 JavaScript engine by the Design Create Play team. A security vulnerability exists in versions prior to NodeBB v1.18.6, which stems from the presence of a Remote Code Execution RCE vulnerability tha...

PT-2023-28726 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions prior to 1.18.6 Description: A remote code execution issue in the "xmlrpc.php" endpoint allows attackers to execute arbitrary code via crafted XML-RPC requests. Recommendations: For versions prior to 1.18.6, update to version...

CVE-2023-43187

NodeBB

CVE-2023-43187

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

CVE-2023-43187

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

CVE-2023-43187

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...

The vulnerability of the NodeBB Forum software lies in the incorrect path name limitation for accessing the restricted directory. This allows a violator to execute arbitrary code.

The vulnerability of the NodeBB Forum software exists due to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Websocket Session Hijacking

nodebb is vulnerable to Websocket Session Hijacking. The vulnerability exists due to missing csrf token in the request which allows an attacker to gain access to private information via cross-origin websocket session hijacking...

GHSA-4QCV-QF38-5J3J Unintentional leakage of private information via cross-origin websocket session hijacking

Impact Private messages or posts might be leaked to third parties if victim opens the attackers site while browsing nodebb. Patches Patched in v3.1.3 Backported to v2.x line via v2.8.13 Workarounds Users can cherry-pick...