@a11ywatch/a11ywatch (>=0.0.1, <=0.3.82), @a11ywatch/core (>=0.1.1, <=0.8.17) +49 more potentially affected by unknown CVE via apollo-server-core (>=3.0.0-html.2, <=3.12.0)

apollo-server-core NPM version =3.0.0-html.2, =0.0.1, =0.1.1, =4.9.2, =1.0.1, =1.1.22, =1.1.19, =1.0.0, =1.1.0, =1.0.0, =0.1.0-alpha.0, =0.1.0-alpha.1, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =10.0.1, =11.3.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J5G3-5C8R-7QFX...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

PT-2023-33035 · Unknown · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to the latest version Description: The issue concerns Apollo Server logging sensitive information, specifically Studio API keys, under certain conditions. This occurs when API keys are passed with leading or...

HPESBHF04513 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00813, 2023.3 IPU - BIOS Advisory, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4510 Gen10 System - Prior to 2.9007-20-2023 HPE ProLiant XL230k Gen10 Server - Prior to 2.9007-20-2023 HPE ProLian...

HPESBHF04516 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00837, 2023.3 IPU - Intel Xeon Processor Advisory, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 2000 Gen10 Plus System - Prior to 1.8007-05-2023 HPE ProLiant XL220n Gen10 Plus Server - Prior to 1.8007-05-2023 HPE ProLiant XL290n Gen10 Plus Server - Prior to...

HPESBHF04514 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00828, 2023.3 IPU - Intel Processor Advisory, (GDS/Gather/Downfall),Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4510 Gen10 System - Prior to 2.9007-20-2023 HPE ProLiant XL230k Gen10 Server - Prior to 2.9007-20-2023 HPE Apollo 4200 Gen10 Server - Prior to 2.9007-20-2023 HPE...

apollo-core.com Cross Site Scripting vulnerability OBB-3439268

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

@apollo/server-integration-testsuite (>=4.7.1, <=4.7.3), @athenajs/core (>=0.0.1, <=0.0.17) +4 more potentially affected by unknown CVE via @apollo/server (>=4.7.1, <=4.7.3)

@apollo/server NPM version =4.7.1, =4.7.1, =0.0.1, =0.5.0-rc.0, =0.0.1, =0.0.1, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-68JH-RF6X-836F...

GHSA-68JH-RF6X-836F @apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...

@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...

PT-2023-32982 · Apollo Graphql · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to 4.7.4 Description: The issue concerns the improper application of Content Security Policies CSP in Apollo Server's landing pages, which could fail to prevent XSS attacks if a viable attack vector exists. Althou...

3rd-Party Reddit App Apollo Forced to Shut Down Due to API Charges

By Waqas Apollo app will be shut down on June 30th, 2023. This is a post from HackRead.com Read the original post: 3rd-Party Reddit App Apollo Forced to Shut Down Due to API Charges...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details IBM X-Force ID: 239925 DESCRIPTION: Apollo GraphQL Apollo Server is vulnerable to web cache poisoning, caused by improper handling of cache-control response header. By modifying HTTP request headers, an...

HPESBHF04478 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00807, 2023.2 IPU - BIOS Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 2000 System - Prior to v2.8004-20-2023 HPE Apollo 4200 Gen10 Server - Prior to v2.8004-20-2023 HPE Apollo 4510 Gen10 System - Prior to v2.8004-20-2023 HPE Apollo...

apollo-automobil.com Cross Site Scripting vulnerability OBB-3303240

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

HPESBHF04441 rev.1 - HPE Apollo, XL Servers Using Intel Server Platform Services (SPS) Firmware, INTEL-SA-00718, 2023.1 IPU - Intel Chipset Firmware Advisory, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 2000 Gen10 Plus System - Prior to SPS 04.04.04.300 HPE ProLiant XL220n Gen10 Plus Server - Prior to SPS 04.04.04.300 HPE ProLiant XL290n Gen10 Plus Server - Prior t...

Apollo has potential access control security issue in eureka

Impact If users expose the apollo-configservice to the internetwhich is not recommended, there are potential security issues since there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and...

GHSA-368X-WMMG-HQ5C Apollo has potential access control security issue in eureka

Impact If users expose the apollo-configservice to the internetwhich is not recommended, there are potential security issues since there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and...

GHSA-FMXQ-V8MG-QH25 apollo-portal has potential CSRF issue

Impact A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Patches Cookie SameSite strategy was set to Lax in 4664 and was...