PT-2021-23943

Name of the Vulnerable Software and Affected Versions: Mercurius versions 8.10.0 through 8.11.1 Description: The issue affects Mercurius, a GraphQL adapter for Fastify, where users can be subjected to a denial of service attack by sending a malformed JSON to the /graphql API endpoint, unless they...

CVE-2021-39915: Exposure of Resource to Wrong Sphere

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects...

PT-2021-22761 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 through 14.3.6 GitLab CE/EE versions 14.4 through 14.4.4 GitLab CE/EE versions 14.5 through 14.5.2 Description: The issue is related to improper access control in the GraphQL API, allowing an attacker to see the nam...

CVE-2021-43801: Improper Check for Unusual or Exceptional Conditions

Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. The vulnerability has been fixed in...

Mercurius code issue vulnerabilities

Mercurius is a GraphQL adapter Fastify . Mercurius 8.10.0 to 8.11.1 has a code issue vulnerability that could be exploited by an attacker to cause a denial of service attack...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b299417a-5725-11ec-a587-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b299417a-5725-11ec-a587-001b217b3468 advisory. - Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4...

Exploit for Cross-site Scripting in Prisma Graphql-Playground-Html

This is a PoC exploit for CVE-2020-4038, an XSS Reflection attack vulnerability in the GraphQL Playground repository. The vulnerability is present in the graphql-playground-html package, which is used by several other packages, including graphql-playground-express, graphql-playground-koa,...

WS-2021-0418

In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting vulnerabili...

Cross-site Scripting (XSS)

graphql-playground-react is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in Properties.html allowing an attacker to inject and execute malicious javascript...

GHSA-QM7X-RC44-RRQW Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)

Impact In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +78 more potentially affected by unknown CVE via apollo-server (>=2.0.0, <=2.25.0)

apollo-server NPM version =2.0.0, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.0.0-d99f4ac.0, =1.27.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-QM7X-RC44-RRQW...

Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)

Impact In certain configurations, Apollo Server serves the client-side web app "GraphQL Playground" from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations. There is a cross-site scripting...

@cromwell/cms (>=1.1.7, <=2.1.12), @cromwell/server (>=1.1.7, <=2.1.7) +2 more potentially affected by unknown CVE via apollo-server (>=3.1.1, <=3.3.0)

apollo-server NPM version =3.1.1, =1.1.7, =1.1.7, =0.7.0, =0.7.5-next.28 - nuk-recommendation-service 3.49.0 Source cves: unknown CVE Source advisory: OSV:GHSA-QM7X-RC44-RRQW...

@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41248 +1 more via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41248,...

@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41249 via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41249 Source...

GHSA-59R9-6JP6-JCM7 XSS vulnerability in GraphQL Playground from untrusted schemas

GraphQL Playground introspection schema template injection attack: Advisory Statement This is a security advisory for an XSS vulnerability in graphql-playground. A similar vulnerability affects graphiql, the package from which graphql-playground was forked. There is a corresponding graphiql...

XSS vulnerability in GraphQL Playground from untrusted schemas

GraphQL Playground introspection schema template injection attack: Advisory Statement This is a security advisory for an XSS vulnerability in graphql-playground. A similar vulnerability affects graphiql, the package from which graphql-playground was forked. There is a corresponding graphiql...

GraphiQL introspection schema template injection attack

Impact - 2. Scope - 3. Patches - 3.1 CDN bundle implementations may be automatically patched - 4. Workarounds for Older Versions - 5. How to Re-create the Exploit - 6. Credit - 7. References - 8. For more information This is a security advisory for an XSS vulnerability in graphiql. A similar...

PT-2021-24452

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to 2.25.3 Apollo Server versions prior to 3.4.1 Description: A cross-site scripting vulnerability exists in GraphQL Playground, which is served by Apollo Server in certain configurations. This vulnerability allows...

Template Injection

graphql-playground is vulnerable to template injection. An attacker is able to set malicious graphql schema URL dynamically via a vulnerable schema of custom graphiql implementation of graphiql's fetcher...