directus (>=11.1.0, <=11.2.2) potentially affected by CVE-2024-54151 via @directus/api (>=22.2.0, <=23.1.3)

@directus/api NPM version =22.2.0, =11.1.0, =11.2.2 Source cves: CVE-2024-54151 Source advisory: OSV:GHSA-849R-QRWJ-8RV4...

@directus/api (>=20.0.0-rc.0, <=23.1.3) potentially affected by CVE-2024-54151 via directus (>=11.0.0, <=11.2.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.1.3 Source cves: CVE-2024-54151 Source advisory: OSV:GHSA-849R-QRWJ-8RV4...

Directus 信息泄露漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. An information disclosure vulnerability exists in Directus version 11.0.0 and versions prior to 11.3.0, which stems from a setting of WEBSOCKETSGRAPHQLAUTH or...

@directus/api (>=20.0.0-rc.0, <=23.1.2) potentially affected by CVE-2024-54128 via directus (>=11.0.0, <=11.2.1)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.1.2 Source cves: CVE-2024-54128 Source advisory: OSV:GHSA-R6WX-627V-GH2F...

@directus/api (>=18.0.0, <=23.1.0), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +3 more potentially affected by CVE-2024-54128 via @directus/app (>=11.0.0, <=13.3.0)

@directus/app NPM version =11.0.0, =18.0.0, =1.2.2, =10.10.0, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2024-54128 Source advisory: OSV:GHSA-R6WX-627V-GH2F...

@directus/api (>=18.0.0, <=21.0.1) potentially affected by CVE-2024-54128 via directus (>=10.10.0, <=10.13.2)

directus NPM version =10.10.0, =18.0.0, =21.0.1 Source cves: CVE-2024-54128 Source advisory: OSV:GHSA-R6WX-627V-GH2F...

GHSA-R6WX-627V-GH2F Directus has an HTML Injection in Comment

Summary The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. Details The Comment feature implements a...

CVE-2024-54128

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128 Directus has an HTML Injection in Comment

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128

Directus (Comment feature) is vulnerable to HTML injection because a client-side filter for restricted characters can be bypassed. The CVE notes that this bypass enables injection of HTML content, with documented impact and a fix in versions 10.13.4 and 11.2.0. Affected components: Directus core ...

CVE-2024-54128 Directus has an HTML Injection in Comment

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

CVE-2024-54128 Directus has an HTML Injection in Comment

Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application...

Directus 安全漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. A security vulnerability exists in Directus 10.10.0 and earlier versions, which stems from a filter in the commenting feature that runs only on the client side and can be...

CVE-2024-47822

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822

CVE-2024-47822 – Directus : The issue arises from access tokens in query strings not being redacted when LOG_STYLE is set to raw, allowing potential exposure of long‑lived tokens in system logs. This could enable an attacker with log access to gain administrative control or perform unauthorized d...

Directus 日志信息泄露漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. Directus suffers from a log information disclosure vulnerability that stems from access tokens being output unprocessed to logs when LOGSTYLE is set to raw...

PT-2024-32834 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.13.2 Description: The issue concerns the exposure of access tokens from query strings in system logs, potentially allowing an attacker to gain administrative control and access to unauthorized data. This occurs...