@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @3wks/gae-node-nestjs (>=0.1.3, <=5.2.0-rc3) +479 more potentially affected by unknown CVE via apollo-server-express (>=1.0.5, <=2.14.1)

apollo-server-express NPM version =1.0.5, =3.10.1, =0.1.3, =0.1.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.0.1-0.0.7.0, =1.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0111...

WS-2020-0111

Apollo-server-express before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

Regular Expression Denial of Service (ReDoS)

Overview @apollo/server is a spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. Successor to apollo-server-core, et al. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer...

Information Disclosure

apollo-server-express is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Exposure

Overview Versions of apollo-server-express prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +126 more potentially affected by unknown CVE via apollo-server-express (>=2.0.0-beta.0, <=2.14.1)

apollo-server-express NPM version =2.0.0-beta.0, =3.10.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =1.0.5, =3.9.0, =1.0.3, =1.2.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +126 more potentially affected by unknown CVE via apollo-server-express (>=2.0.0-beta.0, <=2.14.1)

apollo-server-express NPM version =2.0.0-beta.0, =3.10.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =1.0.5, =3.9.0, =1.0.3, =1.2.7 and more Source cves: unknown CVE Source advisory: GHSA-W42G-7VFC-XF37...