CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

Graphql-upload 代码问题漏洞

Graphql-upload is a middleware and upload scalar from the individual developer Jayden Seric in Australia. It is used to add support for GraphQL multi-part requests uploading files via queries and mutations to various Node.js Graphql servers. A security vulnerability exists in Graphql-upload versi...

CVE-2022-29353: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

PT-2022-19558

Name of the Vulnerable Software and Affected Versions Graphql-upload version 13.0.0 Description The issue allows attackers to execute arbitrary code via a crafted filename, exploiting an arbitrary file upload vulnerability in the file upload module. Recommendations For Graphql-upload version...

@airy/maleo (>=0.1.0, <=0.3.1-canary.36), @ardatan/graphql-to-config-schema (>=0.1.19, <=0.1.20) +50 more potentially affected by CVE-2022-1650 via eventsource (>=1.0.1, <=1.1.0)

eventsource NPM version =1.0.1, =0.1.0, =0.1.19, =1.1.1, =0.6.0-beta-1, =2.0.1-alpha.18, =4.1.1-alpha-0188b2d.0, =0.4.5-alpha-4d4e438.0, =0.0.5-alpha-cc593a47.0, =0.8.2-alpha-4c2d524a.0, =0.5.2, =0.0.1, =0.0.1, =6.2.8-alpha-006f5787.0, =6.5.1-alpha-3f7e98ee.0, =6.10.0-alpha-a4628cc4.0 -...

Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

GHSA-W3XG-7Q6M-3XWP Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

CVE-2019-25060 WP-GraphQL < 0.3.5 - Improper Access Control

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

WordPress plugin WPGraphQL 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin WPGraphQL versions prior to 0.3.5 are vulnerable to an access control error that...

CVE-2019-25060: Improper Access Control

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

Design/Logic Flaw

DISPUTED Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors."...

CVE-2022-30288

CVE-2022-30288 affects Agoo (Ruby HTTP server). The vulnerability arises in versions before 2.14.3 where GraphQL fragment spreads that form cycles are not rejected, potentially causing an application crash. Multiple validated sources (NVD, Red Hat, OSV, CVE lists, PT Security, CNNVD) confirm the ...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

CVE-2022-30288: Undefined Security Weakness

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

This Week in Spring - April 26th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week I was hoping to be in glorious Chicago, Illinois for the first in-person SpringOne Tour installment since the pandemic. But, alas, I couldnt go because - out of an abundance of caution, and since I was exposed to...

GitLab 13.2 < 14.4.5 / 14.5 < 14.5.3 / 14.6 < 14.6.2 (CVE-2022-0172)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowi...