Null pointer dereference

Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain instances of SpiAccessLib could be tricked into writing 0xff to arbitrary system and SMRAM addresses. Fixed in: INTEL Purley-R: 05.21.51.00...

HTTP Request Smuggling

apollo-server is vulnerable to HTTP request smuggling. The vulnerability exists because the library does not properly set the cache-control response header in the batched HTTP requests, allowing an attacker to smuggle HTTP requests...

Batched HTTP requests may set incorrect `cache-control` response header

Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server...

GHSA-8R69-3CVP-WXC3 Batched HTTP requests may set incorrect `cache-control` response header

Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server...

@a11ywatch/a11ywatch (>=0.0.1, <=0.1.65), @a11ywatch/core (>=0.1.1, <=0.5.158) +39 more potentially affected by unknown CVE via apollo-server-core (>=3.0.0-html.2, <=3.10.4)

apollo-server-core NPM version =3.0.0-html.2, =0.0.1, =0.1.1, =1.0.1, =1.1.22, =1.1.19, =0.1.0-alpha.0, =0.1.0-alpha.1, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =10.0.1, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =0.0.27, =0.0.64 and more Source cves: unknown CVE Source advisory:...

PT-2022-28222 · Unknown · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions 3.0.0 through 3.10.0 Apollo Server versions 4.0.0 through 4.0.0 Description: The cache-control HTTP response header may not reflect the cache policy for HTTP requests with multiple operations using HTTP batching. This...

Batched HTTP requests may set incorrect `cache-control` response header

Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server...

Malicious code in @nexthink/apollo-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3596f839602da6a9bf358c4e2d46e8b16727da99621ec65e3986e417e8f6186b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/apollo-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2442bca6d9a3dd356ea5faa389a7389021876ef535ddd23ff709bb803655af2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-456 Malicious code in @nexthink/apollo-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faa168f6a74af14b39193cdea04f9798ab2d20f8ad531d396b5207580e9fc5b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/apollo-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faa168f6a74af14b39193cdea04f9798ab2d20f8ad531d396b5207580e9fc5b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +80 more potentially affected by unknown CVE via apollo-server (>=2.0.0, <=2.25.3)

apollo-server NPM version =2.0.0, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.0.0-d99f4ac.0, =1.27.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2P3C-P3QW-69R4...

GHSA-2P3C-P3QW-69R4 The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations

Impact The graphql-upload npm package can execute GraphQL operations contained in content-type: multipart/form-data POST requests. Because they are POST requests, they can contain GraphQL mutations. Because they use content-type: multipart/form-data, they can be "simple requests" which are not...

The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations

Impact The graphql-upload npm package can execute GraphQL operations contained in content-type: multipart/form-data POST requests. Because they are POST requests, they can contain GraphQL mutations. Because they use content-type: multipart/form-data, they can be "simple requests" which are not...

PT-2022-28174 · Apollo · Apollo Server 2 +1

Name of the Vulnerable Software and Affected Versions: Apollo Server 2 versions prior to 2.25.4 Apollo Server versions that manually integrate with graphql-upload and do not have CSRF prevention enabled Description: The graphql-upload npm package can execute GraphQL operations contained in...

apollo-core.com Cross Site Scripting vulnerability OBB-2935656

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GraphCrawler - GraphQL Automated Security Testing Toolkit

Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e' option and Graphinder will do subdomain enumeration + search popular...

HPESBHF04354 rev.1 - Certain HPE ProLiant Apollo, XL Servers Using Certain Intel Processor BIOS, INTEL-SA-00686, 2022.2 IPU – Intel BIOS Advisory, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL220n Gen10 Plus Server - Prior to 1.6408-11-2022 HPE ProLiant XL290n Gen10 Plus Server - Prior to 1.6408-11-2022 HPE Apollo 2000 Gen10 Plus System - Prior to...

HPESBHF04344 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00657, 2022.2 IPU - Intel Processor Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL220n Gen10 Plus Server - Prior to 1.6408-11-2022 HPE ProLiant XL290n Gen10 Plus Server - Prior to 1.6408-11-2022 HPE Apollo 2000 Gen10 Plus System - Prior to...

CVE-2022-22897

A SQL injection vulnerability in the productalloneimg and imageproduct parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data...