CVE-2024-3127

Technical details of CVE-2024-3127 are not publicly provided in the submitted documents; no affected products, versions, or remediation details are included here. Monitor for updates.

CVE-2024-3127: Improper Access Control

An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 12.5 through 17.1.6, 17.2 through 17.2.4, and 17.3 through 17.3.1, which stems from the fact that under certain circumstances, it may...

GitLab 12.5 < 17.1.6 / 17.2 < 17.2.4 / 17.3 < 17.3.1 (CVE-2024-3127)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under...

Gitlab -- vulnerabilities

Gitlab reports: The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases Denial of Service by importing maliciously crafted GitHub repository Prompt injection in "Resolve Vulnerabilty" results in arbitrary command execution in victim's pipeline ...

Exploit for CVE-2021-4191

This repository contains a collection of exploits and proof-of-concept POC code for various vulnerabilities, including a high-severity vulnerability in Android versions 12 and 13 CVE-2024-0044, an unauthenticated remote command execution RCE vulnerability in BYOB Build Your Own Botnet v2.0.0, and...

Defend Your GraphQL Server Against Excessive Resource Consumption

...

Security Bulletin: Several Security Vulnerabilities were discovered in IBM Security Directory Suite. (CVE-2023-24998, CVE-2023-28867, CVE-2023-0482)

Summary Several vulnerabilities were addressed in WebSphere Application Server Liberty components shipped with the IBM Security Directory Suite Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit t...

GraphQL Vulnerabilities and Common Attacks: Seen in the Wild

In our previous blog, we provided an overview of GraphQL security, along with details and examples of common attacks. Building on that foundation, this blog will take a closer look at real-world examples of GraphQL attacks that have recently occurred. We will explore the methods used by attackers...

HackerOne: IDOR Vulnerability at AddTagToAssets operation name

The IDOR vulnerability was discovered in the AddTagToAssets operation name of a GraphQL endpoint. The vulnerability allowed an attacker to obtain the IDs of custom tags created by a victim by decoding the base64-encoded tagId parameter in the request. This revealed the format and pattern of the t...

Denial Of Service (DoS)

com.graphql-java: graphql-java is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of ExecutableNormalizedFields ENFs in introspection queries, allowing attackers to send queries that can overwhelm the service and cause it to become unresponsive...

GHSA-H9MQ-F6Q5-6C8M GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENFs as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions...

com.atlassian:nadel (>=2022-04-13t01-44-07-9478f8ae, <=2022-05-05t01-56-52-3dbe727f) potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (0.0.0-2022-04-13t00-55-03-2148cdf3)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-04-13t00-55-03-2148cdf3 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-04-13t01-44-07-9478f8ae,...

com.atlassian:nadel (>=2022-03-01t01-46-13-f56480cc, <=2022-03-02t01-26-59-bc167912), com.atlassian:nadel-api (>=2022-03-01t01-46-13-f56480cc, <=2022-03-02t01-26-59-bc167912) +3 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (0.0.0-2022-02-28t04-15-47-83c97ebe)

com.graphql-java:graphql-java MAVEN version 0.0.0-2022-02-28t04-15-47-83c97ebe is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.atlassian:nadel =2022-03-01t01-46-13-f56480cc,...

com.graphql-java:graphql-java-extended-scalars (>=17.0-beta1, <=2021-07-20t10-05-45-ac72af3), com.graphql-java:graphql-java-extended-validation (>=17.0.0-beta1, <=2021-07-21t09-32-32-d779f85) +2 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (17.0-beta1)

com.graphql-java:graphql-java MAVEN version 17.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:graphql-java-extended-scalars =17.0-beta1, =17.0.0-beta1, =7.0.0, =0.0.39,...

GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENFs as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions...

com.graphql-java-generator.graphql-gradle-plugin:com.graphql-java-generator.graphql-gradle-plugin.gradle.plugin (>=2.0rc1, <=2.0), com.graphql-java-generator:graphql-gradle-plugin (>=2.0rc1, <=2.0) +19 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (18.4)

com.graphql-java:graphql-java MAVEN version 18.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: -...

com.arianegraphql:graphql-ktx (>=0.0.3, <=0.0.4), com.arianegraphql:server (>=0.0.3, <=0.0.6) +61 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (17.2)

com.graphql-java:graphql-java MAVEN version 17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.arianegraphql:graphql-ktx =0.0.3, =0.0.3, =0.0.3, =5.0.0-alpha.4, =5.0.0-alpha.4, =5.0.0-alpha.4,...

br.com.m4rc310:br-com-m4rc310-graphql (1.0.1), br.com.m4rc310:br-com-m4rc310-libs (1.0.1) +58 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (18.5)

com.graphql-java:graphql-java MAVEN version 18.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 -...

com.graphql-java:graphql-java-servlet (>=4.6.0, <=4.7.0), com.graphql-java:graphql-java-tools (>=4.2.0, <=4.3.0) +21 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (6.0)

com.graphql-java:graphql-java MAVEN version 6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:graphql-java-servlet =4.6.0, =4.2.0, =3.10.0, =3.10.0, =0.3.1, =0.3.1, =0.3.1, =1.5.7,...