Information Exposure

Overview Versions of apollo-server-azure-functions prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

GHSA-W42G-7VFC-XF37 Introspection in schema validation in Apollo Server

We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions. Impact If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), ra-gen-ui-lib (>=1.0.0-rc.3, <=1.0.0-rc.5) potentially affected by unknown CVE via apollo-server-micro (>=2.9.16, <=2.14.1)

apollo-server-micro NPM version =2.9.16, =0.6.3-canary.85.acbf24c.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@carlosbajo/graphql-gateway (>=2.3.10, <=2.4.62), @egg-type-graphql/egg-graphql (>=2.8.1, <=2.8.3) +19 more potentially affected by unknown CVE via apollo-server-koa (>=2.0.4, <=2.9.12)

apollo-server-koa NPM version =2.0.4, =2.3.10, =2.8.1, =2.4.8, =0.2.1, =0.5.1, =0.2.1, =0.5.1, =0.2.6, =0.1.2, =0.1.6, =0.3.10, =0.3.10, =2.3.7, =2.8.1, =2.8.2 - @openpracticelibrary/strapi-plugin-graphql 3.0.0-beta.20.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +126 more potentially affected by unknown CVE via apollo-server-express (>=2.0.0, <=2.14.1)

apollo-server-express NPM version =2.0.0, =3.10.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =1.0.5, =3.9.0, =1.0.3, =1.2.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +58 more potentially affected by unknown CVE via apollo-server (>=2.0.0, <=2.14.1)

apollo-server NPM version =2.0.0, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.0.0-d99f4ac.0, =1.27.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3), @aerogear/apollo-voyager-server (>=0.1.0, <=0.2.7-rc3) +132 more potentially affected by unknown CVE via apollo-server-core (>=2.0.0, <=2.12.0)

apollo-server-core NPM version =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.5.1-alpha.0, =2.11.0, =3.9.0, =2.2.0-alpha.1, =2.3.10, =1.0.0, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@forecastr/api (>=0.0.4, <=0.0.5), @hammerframework/api (>=0.0.1-alpha.13, <=0.0.1-alpha.14) +8 more potentially affected by unknown CVE via apollo-server-lambda (>=2.0.0-xrc.11, <=2.11.0)

apollo-server-lambda NPM version =2.0.0-xrc.11, =0.0.4, =0.0.1-alpha.13, =0.0.1-alpha.12, =1.1.0, =0.0.1-alpha.27, =1.0.0, =1.2.1 - photos-production-api 1.0.0 - redwood-express-api 0.8.1 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

Introspection in schema validation in Apollo Server

We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions. Impact If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not...

PT-2020-21539

Name of the Vulnerable Software and Affected Versions Apollo Server versions prior to 2.14.2 apollo-server-core versions prior to 2.14.2 apollo-server-express versions prior to 2.14.2 apollo-server-azure-functions versions prior to 2.14.2 apollo-server-cache-memcached versions prior to 2.14.2...

apollo-magazine.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1164096 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Cross-site Scripting (XSS)

github.com/ctripcorp/apollo is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the variable valueWithHiddenChars in showHiddenChars function in item-modal-directive.js, allowing a malicious user to inject and execute malicious web scripts...

HPESBHF03985 rev.4 - Certain HPE Servers with Intel Xeon SP-based processors, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4200 Gen10 Server - Prior to ROM v2.30 HPE ProLiant BL460c Gen10 Server Blade - Prior to ROM v2.30 HPE ProLiant DL20 Gen9 Server - Prior to ROM v2.86 - Impacted b...

HPESBHF03972 rev.3 - HPE ProLiant, Synergy, Edgeline and Apollo Gen10 Server Platform using TPM, Remote Disclosure of Information

Potential Security Impact: Local: Disclosure of Information; Remote: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Synergy 660 Gen10 Compute Module - Prior to 73.20 HPE ProLiant XL230k Gen10 Server - Prior to 73.20 HPE ProLiant XL190r Gen10 Server -...

GHSA-2P6P-V69P-9MM9 XSS in login form

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

XSS in login form

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

GHSA-FXP8-7H5W-H235 XSS in search engine

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...

XSS in search engine

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...

Alkacon OpenCMS 10.5.x Cross Site Scripting

Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/apollo-template Version: 10.5.x Tested on: 10.5.5 / 10.5.4 CVE : CVE-2019-13234,...