Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

npm

@budibase/server

npm

Budibase Web Server

View on github.com · View on npmjs.org

Security Advisories for @budibase/server in npm

High
10 days ago

Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL GSA_kwCzR0hTQS0zZ3A1LXE0anctM3Y5NM4ABYnC

npm @budibase/server
High
10 days ago

Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema GSA_kwCzR0hTQS1xaHYzLXdqZzgtNmZ4Ns4ABYnB

npm @budibase/server
Critical
10 days ago

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign GSA_kwCzR0hTQS02eHA0LWNmMzctcHBqaM4ABYnA

npm @budibase/server
Moderate
10 days ago

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF GSA_kwCzR0hTQS1jdjk2LTUzNDgtcDVwOM4ABYm-

npm @budibase/server
High
10 days ago

Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection GSA_kwCzR0hTQS1nNnF4LWc0cHItOTJ2N84ABYmp

npm @budibase/server
Moderate
about 1 month ago

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API GSA_kwCzR0hTQS0zNjN3LWh2d2gtdzdtNs4ABXBW

npm @budibase/server
High
about 1 month ago

Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL GSA_kwCzR0hTQS00NG0yLWNyaDctZjRxMs4ABW9A

npm @budibase/server
High
about 1 month ago

Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration GSA_kwCzR0hTQS1mZ3F2LWpoNGctcHZnMs4ABW8_

npm @budibase/server
High
about 1 month ago

Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation GSA_kwCzR0hTQS1ycGo0LTd4MnYtd2pyZs4ABW8-

npm @budibase/server
Critical
3 months ago

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step GSA_kwCzR0hTQS1mY200LTRwajItbTVoZs4ABUuX

npm @budibase/server
High
3 months ago

Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write GSA_kwCzR0hTQS0yd2ZoLXJjd2Ytd2gyM84ABUuW

npm @budibase/server
High
3 months ago

Budibase: Command Injection in Bash Automation Step GSA_kwCzR0hTQS1nanc5LTM0Z2YtcnA2bc4ABUtz

npm @budibase/server
High
3 months ago

@budibase/server: Command Injection in PostgreSQL Dump Command GSA_kwCzR0hTQS03MjZnLTU5d3ItY2o0Y84ABTWI

npm @budibase/server
Critical
over 2 years ago

Budibase affected by VM2 Constructor Escape Vulnerability GSA_kwCzR0hTQS00ZzJ4LXZxNXAtNXZqNs4AA5sL

npm @budibase/server
Potential
Moderate
almost 4 years ago

Budibase Improper Control of Dynamically-Managed Code Resources vulnerability GSA_kwCzR0hTQS14OTJnLTQ5Z2gtNjNxbc4AAu45

npm @budibase/bbui, @budibase/builder, @budibase/worker

Filter by Severity

High 9 Moderate 3 Critical 3