com.github.yunwjr:yun-util-examples (>=0.0.28, <=0.0.29), com.github.yunwjr:yun-util-querydsl (>=0.0.28, <=0.0.29) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.3.0)

com.querydsl:querydsl-jpa MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - com.github.yunwjr:yun-util-examples =0.0.28, =0.0.28, =1.13.0, =1.17.0, =1.17.2 - org.appng:appng-persistence...

com.boschsemanticstack:semanticstack-rql-2-querydsl (1.2.0), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (1.2.0) +3 more potentially affected by CVE-2024-49203 via io.github.openfeign.querydsl:querydsl-jpa (>=6.0.0.m1, <=6.10)

io.github.openfeign.querydsl:querydsl-jpa MAVEN version =6.0.0.m1, =6.0.0.m1, =6.0.0.m2, =6.10 - io.github.zzagtung:querydsl-jpa-postgres-json 0.2.0 Source cves: CVE-2024-49203 Source advisory: GHSA-6Q3Q-6V5J-H6VG...

com.querydsl:querydsl-collections (4.0.3), com.querydsl:querydsl-hibernate-search (4.0.3) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.3)

com.querydsl:querydsl-apt MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.3 - com.querydsl:querydsl-hibernate-search 4.0.3 -...

br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha), br.ufsc.bridge:querydsl-utils (1.1.1) +4 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.1.3)

com.querydsl:querydsl-jpa MAVEN version 4.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - br.com.itsme:commons =0.0.4-alpha, =2.7.0, =3.0.2 Source cves: CVE-2024-49203 Source advisory:...

com.boschsemanticstack:semanticstack-rql-2-querydsl (1.2.0), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (1.2.0) +3 more potentially affected by CVE-2024-49203 via io.github.openfeign.querydsl:querydsl-jpa (>=6.0.0.m1, <=6.10)

io.github.openfeign.querydsl:querydsl-jpa MAVEN version =6.0.0.m1, =6.0.0.m1, =6.0.0.m2, =6.10 - io.github.zzagtung:querydsl-jpa-postgres-json 0.2.0 Source cves: CVE-2024-49203 Source advisory: OSV:GHSA-6Q3Q-6V5J-H6VG...

com.querydsl:querydsl-jpa-codegen (4.0.6) potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.0.6)

com.querydsl:querydsl-jpa MAVEN version 4.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - com.querydsl:querydsl-jpa-codegen 4.0.6 Source cves: CVE-2024-49203 Source advisory: OSV:GHSA-6Q3Q-6V5J-H6VG...

GHSA-6Q3Q-6V5J-H6VG Querydsl vulnerable to HQL injection through orderBy

Summary The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repositoryhttps://github.com/querydsl/querydsl whe...

br.ufsc.bridge:querydsl-utils (1.1.3), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +48 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-jpa (4.2.2)

com.querydsl:querydsl-jpa MAVEN version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-jpa and may be impacted: - br.ufsc.bridge:querydsl-utils 1.1.3 - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation...

Duplicate Advisory: Querydsl SQL/HQL injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references. Original Description Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery...

GHSA-WPVF-5MC3-HV6M Duplicate Advisory: Querydsl SQL/HQL injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references. Original Description Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery...

CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

CVE-2024-49203: Undefined Security Weakness

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

CVE-2024-49203

Summary: CVE-2024-49203 affects Querydsl 5.1.0 and OpenFeign Querydsl 6.8, enabling SQL/HQL injection in the orderBy path of JPAQuery. The issue arises from how untrusted input can influence the OrderSpecifier/orThe orderBy clause, potentially allowing information leakage or denial of service. Re...

PT-2024-33345

Name of the Vulnerable Software and Affected Versions Querydsl version 5.1.0 OpenFeign Querydsl version 6.8 Description The issue allows SQL/HQL injection in the orderBy clause of JPAQuery. This is possible when untrusted input is directly used in query construction. Note that the Querydsl...

Querydsl security vulnerabilities

Querydsl is a framework from the Querydsl open source that supports building type-safe SQL-like queries for multiple backends. A security vulnerability exists in Querydsl version 5.1.0 that stems from allowing SQL or HQL injection in orderBy in JPAQuery...

CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.alexnederlof:jasperreports-plugin (1.7) +69 more potentially affected by CVE-2023-1932 via org.hibernate:hibernate-validator (3.1.0.ga)

org.hibernate:hibernate-validator MAVEN version 3.1.0.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - br.net.woodstock.rockframework:rockframework-domain =1.2.1, =1.5.0, =0.7.9, =1.3, =1.4 and...

Spring for GraphQL 1.0 Release

On behalf of the Spring for GraphQL team and every contributor, it is my pleasure to announce the 1.0 GA release. Its been 10 months since the project was announced and under 2 years since the first commit, unremarkably called "first commit". The project began with the modest goal to replace the...