@directus/api (>=20.0.0-rc.0, <=23.1.2) potentially affected by CVE-2024-54128 via directus (>=11.0.0, <=11.2.1)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.1.2 Source cves: CVE-2024-54128 Source advisory: OSV:GHSA-R6WX-627V-GH2F...

@directus/api (>=18.0.0, <=21.0.1) potentially affected by CVE-2024-54128 via directus (>=10.10.0, <=10.13.2)

directus NPM version =10.10.0, =18.0.0, =21.0.1 Source cves: CVE-2024-54128 Source advisory: OSV:GHSA-R6WX-627V-GH2F...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

directus (>=11.0.0, <=11.0.1) potentially affected by CVE-2024-46990 via @directus/api (>=22.0.0, <=22.1.0)

@directus/api NPM version =22.0.0, =11.0.0, =11.0.1 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

@directus/api (>=20.0.0-rc.0, <=22.1.1) potentially affected by CVE-2024-46990 via directus (>=11.0.0, <=11.0.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =22.1.1 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

@directus/api (>=15.0.0, <=21.0.1), directus-extension-baetorra-booking (>=1.2.0, <=2.0.0) potentially affected by CVE-2024-46990 via directus (>=10.8.3, <=10.13.2)

directus NPM version =10.8.3, =15.0.0, =1.2.0, =2.0.0 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

directus (>=10.9.1, <=10.9.2) potentially affected by CVE-2024-39699 via @directus/api (>=17.0.0, <=17.0.1)

@directus/api NPM version =17.0.0, =10.9.1, =10.9.2 Source cves: CVE-2024-39699 Source advisory: OSV:GHSA-8P72-RCQ4-H6PW...

@directus/api (>=15.0.0, <=19.1.1), directus-extension-baetorra-booking (>=1.2.0, <=2.0.0) potentially affected by CVE-2024-36128 via directus (>=10.8.3, <=10.11.1)

directus NPM version =10.8.3, =15.0.0, =1.2.0, =2.0.0 Source cves: CVE-2024-36128 Source advisory: OSV:GHSA-632P-P495-25M5...

@directus/api (>=18.0.0, <=19.0.2) potentially affected by CVE-2024-34709 via directus (>=10.10.0, <=10.10.7)

directus NPM version =10.10.0, =18.0.0, =19.0.2 Source cves: CVE-2024-34709 Source advisory: OSV:GHSA-G65H-35F3-X2W3...

Directus API vulnerable to denial of service

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

CVE-2020-19850

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

CVE-2020-19850

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

Design/Logic Flaw

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

PT-2023-11539 · Unknown · Directus Api

Name of the Vulnerable Software and Affected Versions: Directus API version 2.2.0 Description: A denial of service issue in the Directus API allows a remote attacker to cause a denial of service by sending a large number of HTTP requests. Recommendations: For Directus API version 2.2.0, consider...

CVE-2020-19850

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

CVE-2020-19850

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

Unspecified Vulnerability in RANGER Studio Directus

RANGER Studio Directus is a set of open source headless CMS and API for managing custom databases from RANGER Studio, U.S.A. The Directus API is one of the components that can add a RESTful API layer to new or existing SQL databases. A security vulnerability exists in the RANGER Studio Directus 7...

CVE-2019-13984

Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...