16 matches found
Querydsl vulnerable to HQL injection through orderBy
Summary The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repositoryhttps://github.com/querydsl/querydsl whe...
com.querydsl:querydsl-jpa-codegen (4.0.0), org.qubership.atp:atp-itf-core (>=4.4.106, <=4.4.115) +38 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.0.0)
com.querydsl:querydsl-jpa MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - com.querydsl:querydsl-jpa-codegen 4.0.0 - org.qubership.atp:atp-itf-core =4.4.106, =4.4.354, =4.4.354,...
io.github.openfeign.querydsl:querydsl-jpa-codegen (>=5.0.1, <=5.6), io.github.zzagtung:querydsl-jpa-postgres-json (0.1.1) potentially affected by CVE-2024-49203 via io.github.openfeign.querydsl:querydsl-jpa (>=5.0.1, <=5.6)
io.github.openfeign.querydsl:querydsl-jpa MAVEN version =5.0.1, =5.0.1, =5.6 - io.github.zzagtung:querydsl-jpa-postgres-json 0.1.1 Source cves: CVE-2024-49203 Source advisory: OSV:GHSA-6Q3Q-6V5J-H6VG...
be.mogo.generator:mogo-generator-model (1.0.0.release), be.mogo.iam:mogo-provisioning (>=1.0.2.release, <=1.1.7.release) +70 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.2.1)
com.querydsl:querydsl-apt MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - be.mogo.generator:mogo-generator-model 1.0.0.release - be.mogo.iam:mogo-provisioning =1.0.2.release,...
com.querydsl:querydsl-jpa-codegen (4.0.2) potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.0.2)
com.querydsl:querydsl-jpa MAVEN version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - com.querydsl:querydsl-jpa-codegen 4.0.2 Source cves: CVE-2024-49203 Source advisory: OSV:GHSA-6Q3Q-6V5J-H6VG...
com.querydsl:querydsl-collections (4.0.2), com.querydsl:querydsl-hibernate-search (4.0.2) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.2)
com.querydsl:querydsl-apt MAVEN version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.2 - com.querydsl:querydsl-hibernate-search 4.0.2 -...
au.net.causal.shoelaces:shoelaces-liquibase-integration-tests-common (2.0), be.mogo.generator:mogo-generator-model (1.0.0.release) +142 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.2.1)
com.querydsl:querydsl-jpa MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - au.net.causal.shoelaces:shoelaces-liquibase-integration-tests-common 2.0 -...
com.github.yunwjr:yun-util-examples (>=0.0.28, <=0.0.29), com.github.yunwjr:yun-util-querydsl (>=0.0.28, <=0.0.29) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.3.0)
com.querydsl:querydsl-jpa MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - com.github.yunwjr:yun-util-examples =0.0.28, =0.0.28, =1.13.0, =1.17.0, =1.17.2 - org.appng:appng-persistence...
com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (1.2.0), com.idontchop:spring-data-querydsl-value-operators (>=0.0.3, <=0.2.0) +4 more potentially affected by CVE-2024-49203 via io.github.openfeign.querydsl:querydsl-apt (>=6.0.0.m1, <=6.10)
io.github.openfeign.querydsl:querydsl-apt MAVEN version =6.0.0.m1, =0.0.3, =6.0.0.m1, =6.0.0.m1, =6.0.0.m2, =6.0.0.m1, =6.10 Source cves: CVE-2024-49203 Source advisory: OSV:GHSA-6Q3Q-6V5J-H6VG...
GHSA-6Q3Q-6V5J-H6VG Querydsl vulnerable to HQL injection through orderBy
Summary The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repositoryhttps://github.com/querydsl/querydsl whe...
io.github.openfeign.querydsl:querydsl-jpa-codegen (>=5.0.1, <=5.6), io.github.zzagtung:querydsl-jpa-postgres-json (0.1.1) potentially affected by CVE-2024-49203 via io.github.openfeign.querydsl:querydsl-jpa (>=5.0.1, <=5.6)
io.github.openfeign.querydsl:querydsl-jpa MAVEN version =5.0.1, =5.0.1, =5.6 - io.github.zzagtung:querydsl-jpa-postgres-json 0.1.1 Source cves: CVE-2024-49203 Source advisory: GHSA-6Q3Q-6V5J-H6VG...
br.ufsc.bridge:querydsl-utils (1.1.3), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +51 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.2.2)
com.querydsl:querydsl-apt MAVEN version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - br.ufsc.bridge:querydsl-utils 1.1.3 - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation...
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...
CVE-2024-49203
creationtimestamp| type| source ---|---|--- 2024-11-20 20:29:58+00:00| seen| https://infosec.exchange/users/cve/statuses/113517173008672878 2024-11-20 22:57:16+00:00| seen| https://t.me/cvedetector/11662 2024-11-27 15:34:53+00:00| published-proof-of-concept|...
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...