Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the automation test results broadcast process. An attacker can obtain sensitive OAuth2 access and refresh tokens belonging to other users by passively listening to...

CVE-2023-3792 Beijing Netcon NS-ASG test_status.php direct request

A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /admin/teststatus.php. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The associated identifier of this...

PT-2023-26187 · Beijing Netcon · Ns-Asg

Name of the Vulnerable Software and Affected Versions: Beijing Netcon NS-ASG version 6.3 Description: A problematic issue has been found in the software, affecting an unknown part of the file /admin/test status.php. The manipulation of this issue leads to a direct request. The details of this iss...

Netcon NS-ASG 安全漏洞

Netcon NS-ASG is an application security gateway from China Netcon Technology Netcon. A security vulnerability exists in Beijing Netcon NS-ASG version 6.3, which originates from the file /admin/teststatus.php that can result in a direct request...