0.258.7
3 years ago
9 hours ago
Known vulnerabilities in the nocodb package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
nocodb is a NocoDB Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the How to fix Cross-site Scripting (XSS)? Upgrade | <0.202.9 |
nocodb is a NocoDB Affected versions of this package are vulnerable to SQL Injection through the How to fix SQL Injection? Upgrade | <0.202.10 |
nocodb is a NocoDB Affected versions of this package are vulnerable to SQL Injection via the Note: This is only exploitable if the attacker has creator permissions. How to fix SQL Injection? Upgrade | <0.111.0 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Improper Input Validation via the How to fix Improper Input Validation? Upgrade | <0.96.0 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Information Exposure due to missing verification in the SMTP plugin. Exploiting this vulnerability allows attackers to make requests to internal servers and read the contents. How to fix Information Exposure? Upgrade | <0.91.7 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Directory Traversal allowing an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the How to fix Directory Traversal? Upgrade | <0.109.6 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Denial of Service (DoS) due to allowing large characters to be inserted in the input field How to fix Denial of Service (DoS)? Upgrade | <0.92.0 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper validation when importing CSV or Excel files via URL. Using this option, exploitation is possible by crafting the How to fix Server-side Request Forgery (SSRF)? Upgrade | <0.92.0 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Privilege Escalation due to the existence of user references in webhook context. NOTE: This vulnerability has also been identified as: CVE-2022-2064 How to fix Privilege Escalation? Upgrade | <0.91.8 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Privilege Escalation due to the existence of user references in webhook context. NOTE: This vulnerability has also been identified as: CVE-2022-2063 How to fix Privilege Escalation? Upgrade | <0.91.8 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of comment data. How to fix Cross-site Scripting (XSS)? Upgrade | <0.91.9 |
nocodb is a NocoDB Affected versions of this package are vulnerable to Observable Discrepancy via the password reset feature. When a password reset is requested, the application displays an error message if the email isn't registered within the system, thus allowing the attacker to enumerate registered emails in the application. How to fix Observable Discrepancy? Upgrade | >=0.9.11 <0.84.1 |