Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2022-3019

Improper Access Control in tooljet/tooljet

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tooljet
Products
Tooljet
CVE-2022-2631

Improper Access Control in tooljet/tooljet

Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Tooljet
Products
Tooljet
CVE-2022-2037

Excessive Attack Surface in tooljet/tooljet

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.

CVSS 3.1 · 8.0 High EPSS 1.2% KEV · Not listed
Vendors
Tooljet
Products
Tooljet
CVE-2022-23068

ToolJet - HTML Injection in Invite New User

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tooljet
Products
Tooljet
CVE-2022-23067

ToolJet - Token Leakage via Referer Header

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Tooljet
Products
Tooljet