Malicious code in arangodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e09e7451852efa7e3e9deea5dc6dd6e2cf678f5368a741c35b2eac846fff21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1769 Malicious code in arangodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e09e7451852efa7e3e9deea5dc6dd6e2cf678f5368a741c35b2eac846fff21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview arangodb is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

Impact If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use @flexSearchFulltext are not affected. The attacker needs...

GHSA-QM4W-4995-VG7F cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

Impact If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use @flexSearchFulltext are not affected. The attacker needs...

SQL Injection

cruddl is vulnerable to sql injection attacks. The vulnerability exists because of the missing sanitizations in the query function in arangodb-adapter.ts which allows a remote attacker to inject and execute malicious javascript script in to the system...

CVE-2022-36084

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...

Code injection

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...

CVE-2022-36084 cruddl vulnerable to AQL injection through flexSearch

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...

CVE-2022-36084 cruddl vulnerable to AQL injection through flexSearch

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...

CVE-2022-36084 cruddl vulnerable to AQL injection through flexSearch

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...

PT-2022-23173 · Arangodb +1 · Arangodb +1

Name of the Vulnerable Software and Affected Versions: cruddl versions 1.1.0 through 2.6.x cruddl versions 3.0.0 through 3.0.1 Description: The issue affects cruddl when used to generate a schema that uses @flexSearchFulltext. Users of that schema may be able to inject arbitrary AQL queries that...

cruddl 安全漏洞

cruddl is an open source library from AEB Germany. Used to create a GraphQL API for your database , using GraphQL SDL for your architecture modeling . cruddl has a security vulnerability , an attacker can use this vulnerability can be able to inject arbitrary AQL queries , these queries will be...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

Server side request forgery (ssrf)

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions 3.7.0 through 3.9.0-alpha.1 allow downloading a Foxx service from a publicly available URL without proper internal request filtering, enabling a highly-privileged attacker to perform blind SSRF and reach localhost. Public documents confirm the root cause as inadequate filter...

CVE-2021-25939 ArangoDB - Blind SSRF when Downloading Foxx Service from URL

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

ArangoDB 代码问题漏洞

ArangoDB is a NoSQL database system from ArangoDB GmbH. A code issue vulnerability exists in ArangoDB versions v3.7.0 through v3.9.0-alpha.1, which stems from the system having a feature that downloads Foxx services from publicly available URLs, but this feature does not enforce proper filtering ...