WS-2020-0116

Apollo-server-lambda before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

WS-2020-0115

Apollo-server-micro before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable nam...

WS-2020-0114

Apollo-server-koa before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names...

WS-2020-0113

Apollo-server-hapi before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...

WS-2020-0112

Apollo-server-fastify before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

WS-2020-0111

Apollo-server-express before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

WS-2020-0110

Apollo-server-cloudflare before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readabl...

WS-2020-0109

Apollo-server-cloud-functions before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

WS-2020-0108

Apollo-server-core before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...

WS-2020-0107

Apollo-server-cache-memcached before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

WS-2020-0106

Apollo-server-azure-functions before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

WS-2020-0105

Apollo-server before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names. Mo...

WS-2019-0352

Information Exposure found in type-graphql before 0.17.6. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request...

@lenne.tech/nest-server (>=0.0.1, <=0.0.23), @tsed/graphql (>=5.34.5, <=5.44.6) +9 more potentially affected by unknown CVE via type-graphql (>=0.17.4, <=0.17.5)

type-graphql NPM version =0.17.4, =0.0.1, =5.34.5, =6.3.0, =1.0.2, =1.0.3 Source cves: unknown CVE Source advisory: MEND:WS-2019-0352...

@atto-byte/yoga (>=0.6.0, <=0.6.6), @britishcouncil/grizzly (>=0.1.0, <=0.3.3) +22 more potentially affected by unknown CVE via graphql-shield (>=3.2.5, <=5.7.3)

graphql-shield NPM version =3.2.5, =0.6.0, =0.1.0, =1.0.2-alpha.11, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.0.6, =0.0.0, =0.0.1, =1.0.0, =0.0.5, =0.0.1, =0.0.2 - ustart 1.0.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0201...

WS-2019-0201

graphql-shield before 6.0.6 has an authorization bypass vulnerability that allows attackers to access information they should not have access to in case of a key collision...

@absa-subatomic/openshift-api (>=0.0.1, <=0.0.2), @atomist-seeds/automation-client (>=1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, <=1.0.0-master.20180928151025) +40 more potentially affected by unknown CVE via graphql-code-generator (>=0.5.5, <=0.17.0)

graphql-code-generator NPM version =0.5.5, =0.0.1, =1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, =1.0.0-atomist-update-1.0.0-M.5a-1538146868055.20180928150114, =1.0.0-atomist-update-1.0.0-M.5a-1538147121196.20180928150530, =0.1.0-master.20181019173228,...

WS-2019-0068

All versions of graphql-code-generator have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project...

WS-2016-0142

GraphQL HTTP is vulnerable to XSS vulnerability. HTML was was not properly escaped in queries or variables causing GraphiQL to break...

bloql (0.7.3), react-sotefront-components-test (>=0.2.0, <=0.2.6) potentially affected by unknown CVE via express-graphql (>=0.4.0, <=0.4.9)

express-graphql NPM version =0.4.0, =0.2.0, =0.2.6 Source cves: unknown CVE Source advisory: MEND:WS-2016-0142...