Information Disclosure

apollo-server-micro is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Disclosure

apollo-server-express is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Disclosure

apollo-server-core is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Disclosure

apollo-server is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Disclosure

apollo-server-koa is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Exposure

Overview Versions of apollo-server-lambda prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relatio...

Information Exposure

Overview Versions of apollo-server-micro prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relation...

Information Exposure

Overview Versions of apollo-server-koa prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...

Information Exposure

Overview Versions of apollo-server-hapi prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...

Information Exposure

Overview Versions of apollo-server-fastify prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

Information Exposure

Overview Versions of apollo-server-express prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

Information Exposure

Overview Versions of apollo-server-cloud-functions prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server-cache-memcached prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server-azure-functions prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

@aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3), @aerogear/apollo-voyager-server (>=0.1.0, <=0.2.7-rc3) +132 more potentially affected by unknown CVE via apollo-server-core (>=2.0.0-beta.0, <=2.12.0)

apollo-server-core NPM version =2.0.0-beta.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.5.1-alpha.0, =2.11.0, =3.9.0, =2.2.0-alpha.1, =2.3.10, =1.0.0, =2.0.0 and more Source cves: unknown CVE Source advisory: GHSA-W42G-7VFC-XF37...

@forecastr/api (>=0.0.4, <=0.0.5), @hammerframework/api (>=0.0.1-alpha.13, <=0.0.1-alpha.14) +8 more potentially affected by unknown CVE via apollo-server-lambda (>=2.0.0-xrc.11, <=2.11.0)

apollo-server-lambda NPM version =2.0.0-xrc.11, =0.0.4, =0.0.1-alpha.13, =0.0.1-alpha.12, =1.1.0, =0.0.1-alpha.27, =1.0.0, =1.2.1 - photos-production-api 1.0.0 - redwood-express-api 0.8.1 Source cves: unknown CVE Source advisory: GHSA-W42G-7VFC-XF37...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), ra-gen-ui-lib (>=1.0.0-rc.3, <=1.0.0-rc.5) potentially affected by unknown CVE via apollo-server-micro (>=2.9.16, <=2.14.1)

apollo-server-micro NPM version =2.9.16, =0.6.3-canary.85.acbf24c.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: GHSA-W42G-7VFC-XF37...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +126 more potentially affected by unknown CVE via apollo-server-express (>=2.0.0-beta.0, <=2.14.1)

apollo-server-express NPM version =2.0.0-beta.0, =3.10.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =1.0.5, =3.9.0, =1.0.3, =1.2.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +58 more potentially affected by unknown CVE via apollo-server (>=2.0.0-rc.5, <=2.14.1)

apollo-server NPM version =2.0.0-rc.5, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.0.0-d99f4ac.0, =1.27.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...