CVE-2022-22120

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221218.0In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can cre CVE-2022-221235.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated atta CVE-2022-221245.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated atta CVE-2022-221254.8In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin CVE-2022-221266.1Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScr CVE-2022-221277.2Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity CVE-2022-221289.8Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could CVE-2022-22135.4A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerabili CVE-2022-221376.5A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malform CVE-2022-221387.5All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. CVE-2022-221397.3Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalati CVE-2022-22148.8A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unk