Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-6x9p-4r67-5gjx
  • npm/@budibase/server
 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` 26 Aug
  • No fix available
  • Severity - 7.1 (High)
GHSA-5fpj-28rv-84r7
  • npm/@budibase/server
 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist 14 Aug
  • Fix available
  • Severity - 7.1 (High)
GHSA-hfhx-w8p8-4hc7
  • npm/@budibase/server
 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation 24 Jul
  • No fix available
  • Severity - 4.9 (Medium)
GHSA-v42f-v8xc-j435
  • npm/@budibase/server
 Budibase: SSRF via DNS rebinding in the REST datasource integration 24 Jul
  • No fix available
  • Severity - 8.5 (High)
GHSA-pmpg-2mxq-6xwr
  • npm/@budibase/server
 Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete 24 Jul
  • No fix available
  • Severity - 7.1 (High)
GHSA-cr7p-cr3q-h5cm
  • npm/@budibase/server
 Budibase: Account Enumeration via Login Lockout Response Differential 24 Jul
  • No fix available
  • Severity - 5.3 (Medium)
GHSA-pvcr-8mvp-w8qr
  • npm/@budibase/server
 Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) 24 Jul
  • No fix available
  • Severity - 7.7 (High)
GHSA-2xgg-r2wc-c5r2
  • npm/@budibase/server
 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector 24 Jul
  • No fix available
  • Severity - 7.6 (High)
GHSA-qw6m-8fw2-2v64
  • npm/@budibase/server
 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution 24 Jul
  • No fix available
  • Severity - 8.3 (High)
GHSA-gh4h-34gr-87r7
  • npm/@budibase/server
 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders 24 Jul
  • No fix available
  • Severity - 5.7 (Medium)
GHSA-hr66-5mqr-8mpx
  • npm/@budibase/server
 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint 24 Jul
  • No fix available
  • Severity - 7.5 (High)
GHSA-mqhr-6j6h-74p5
  • npm/@budibase/server
 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak 24 Jul
  • No fix available
GHSA-hp6v-6jw7-gv2f
  • npm/@budibase/server
 Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified 24 Jul
  • No fix available
  • Severity - 9.0 (Critical)
GHSA-xg5g-26x8-cvf4
  • npm/@budibase/server
 Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution 24 Jul
  • No fix available
  • Severity - 8.5 (High)
GHSA-xcx6-4f2g-hhgx
  • npm/@budibase/server
 Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs 24 Jul
  • No fix available
  • Severity - 7.7 (High)
GHSA-ppr4-5f46-j9c6
  • npm/@budibase/server
 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile 24 Jul
  • No fix available
  • Severity - 7.0 (High)
Load more...