graphql-java:GraphqlFuzzer: Security exception in java.base/sun.nio.cs.CESU_8.newEncoder

Detailed Report: https://oss-fuzz.com/testcase?key=5111413412331520 Project: graphql-java Fuzzing Engine: libFuzzer Fuzz Target: GraphqlFuzzer Job Type: libfuzzerasangraphql-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/sun.nio.cs.CESU8.newEncoder...

SalesAgility SuiteCRM Security Breach

Salesagility SalesAgility SuiteCRM is a suite of enterprise-grade, open source Customer Relationship Management CRM from Salesagility UK. A security vulnerability exists in SalesAgility SuiteCRM versions prior to 8.4.2 that stems from Graphql Introspection being enabled without authentication,...

CVE-2023-47643: Exposure of Sensitive Information to an Unauthorized Actor

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

VulnCheck KEV: CVE-2021-4191

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API...

DRUPAL-CONTRIB-2023-051

The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates create, update, delete through mutations. The module does not sufficiently validate incoming requests that are made from domains other than the one serving the GraphQL endpoint. I...

PT-2023-7609

Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description The issue is related to the incorrect implementation of the sequence of actions in the Quarkus Java framework's WebSocket technology, resulting from insufficient access restriction when...

PT-2023-37037

The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates create, update, delete through mutations. The module does not sufficiently validate incoming requests that are made from domains other than the one serving the GraphQL endpoint. I...

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2023-050

This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...

GraphQL - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2023-051

The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates create, update, delete through mutations. The module does not sufficiently validate incoming requests that are made from domains other than the one serving the GraphQL endpoint. I...

PT-2023-37036

This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...

graphql-java:GraphqlFuzzer: Security exception in java.base/java.util.HashMap.resize

Detailed Report: https://oss-fuzz.com/testcase?key=5622385220648960 Project: graphql-java Fuzzing Engine: libFuzzer Fuzz Target: GraphqlFuzzer Job Type: libfuzzerasangraphql-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.HashMap.resize...

A.S. Watson Group : Access to internal info via Graphql on https://tng-api.watsons.com.my

Vulnerability description not provided...

HackerOne: IDOR vulnerability in unreleased HackerOne Copilot feature

An unreleased feature of HackerOne's Copilot was vulnerable to IDOR through a GraphQL mutation. By supplying another user's conversation ID, an attacker could have deleted conversations in the Copilot interface before this issue was addressed...

Denial Of Service (DOS)

github.com/ethereum/go-ethereum is vulnerable to Denial of Service. This vulnerability exists when --http --graphql is used which allows an attacker to cause an application crash via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand...

GitHub: RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention

A race condition was discovered in GitHub Enterprise Server that allowed an administrator to retain access permissions on repositories after transfer. This was possible by manipulating repository permissions through a GraphQL mutation during the transfer process. The vulnerability affected GitHub...

go-ethereum vulnerable to denial of service via crafted GraphQL query

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...

GHSA-V9JH-J8PX-98VQ go-ethereum vulnerable to denial of service via crafted GraphQL query

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...

CVE-2023-42319

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...

CVE-2023-42319

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...

Code injection

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...