CVE-2019-13235

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

Code injection

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

Code injection

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...

CVE-2019-13235

CVE-2019-13235 affects Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, with a Cross-Site Scripting (XSS) flaw in the login form. Public sources describe the vulnerability as an XSS in the login workflow, with PoCs showing injection potentially via headers like X-Forwarded-For. NVD metrics list...

CVE-2019-13235

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

CVE-2019-13235

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

CVE-2019-13234

CVE-2019-13234 involves XSS in the Alkacon OpenCms Apollo Template, specifically in the search engine for OpenCms Apollo Template 10.5.4 and 10.5.5. The connected documents confirm a reflected XSS vulnerability in the search endpoint (e.g., parameter q) and also show a related XSS condition in a ...

CVE-2019-13234

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...

CVE-2019-13234

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...

CVE-2019-13235: Improper Neutralization of Input During Web Page Generation

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form...

CVE-2019-13234: Improper Neutralization of Input During Web Page Generation

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine...

PT-2019-13196

Name of the Vulnerable Software and Affected Versions Alkacon OpenCms Apollo Template versions 10.5.4 through 10.5.5 Description The issue is related to a Cross-Site Scripting XSS flaw in the search engine of the affected software. Recommendations For versions 10.5.4 and 10.5.5, consider disablin...

PT-2019-13197

Name of the Vulnerable Software and Affected Versions Alkacon OpenCms Apollo Template versions 10.5.4 through 10.5.5 Description The issue concerns a Cross-Site Scripting XSS flaw in the Login form. Recommendations For versions 10.5.4 and 10.5.5, update to a version that fixes the XSS issue in th...

Prototype Pollution in @apollo/gateway

Versions of @apollo/gateway prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the...

GHSA-74CR-77XC-8G6R Prototype Pollution in @apollo/gateway

Versions of @apollo/gateway prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in @apollo/gateway...

PT-2019-20019

Name of the Vulnerable Software and Affected Versions @apollo/gateway versions prior to 0.6.2 Description The issue allows attackers to alter the Object prototype through queries with GraphQL aliases, potentially leading to Denial of Service or Remote Code Execution when chained with other...

Prototype Pollution

Overview Versions of @apollo/gateway prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objec...

GHSA-FVX3-G627-PHM2 Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled...

Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled...