Information Exposure

Overview Versions of apollo-server-hapi prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...

Information Exposure

Overview Versions of apollo-server-fastify prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

Information Exposure

Overview Versions of apollo-server-express prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

Information Exposure

Overview Versions of apollo-server-cloud-functions prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server-cache-memcached prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server-azure-functions prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, thei...

Information Exposure

Overview Versions of apollo-server prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

@3wks/gae-node-nestjs (>=0.1.3 <=5.2.0-rc3), @abyssaljs/plugin-graphql (>=0.1.1 <=0.5.0) +409 more potentially affected by unknown CVE via apollo-server-express (>=1.0.5 <=2.14.1)

apollo-server-express NPM version =1.0.5, =0.1.3, =0.1.1, =0.7.2-dev.409.01ecc9f.0, =0.7.2-dev.409.01ecc9f.0, =2018.8.28-0, =0.0.1, =0.1.0-alpha.10a87555, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0-latest.5b715197, =2.1.0, =5.4.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-X...

@hello10/jump-server (>=1.0.0 <=1.1.3) potentially affected by unknown CVE via apollo-server-cloud-functions (=2.13.0)

apollo-server-cloud-functions NPM version =2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-server-cloud-functions and may be impacted: - @hello10/jump-server =1.0.0, =1.1.3 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

8base-cli (>=0.0.80 <=0.0.90), @3wks/gae-node-nestjs (>=0.1.3 <=5.2.0-rc3) +494 more potentially affected by unknown CVE via apollo-server-core (>=1.3.2 <=2.12.0)

apollo-server-core NPM version =1.3.2, =0.0.80, =0.1.3, =0.1.1, =2018.8.28-0, =0.0.1, =2.11.0, =0.0.1-alpha, =2.0.0, =0.1.0-alpha.10a87555, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

8base-cli (>=0.0.80 <=0.0.90), @awoyotoyin/ts-graphql-yoga-express-starter (=1.0.0) +128 more potentially affected by unknown CVE via apollo-server-lambda (>=1.3.2 <=2.11.0)

apollo-server-lambda NPM version =1.3.2, =0.0.80, =0.1.0-latest.5b715197, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =1.0.0, =1.7.0, =0.0.1, =1.0.1-alpha.0, =1.0.0, =1.16.9 - @jokio/graphql-yoga =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

GHSA-W42G-7VFC-XF37 Introspection in schema validation in Apollo Server

We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions. Impact If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not...

codelift (>=1.0.1 <=1.0.15-canary.394.652cc97.0), graphql-server-micro (>=1.0.2 <=1.4.1) +8 more potentially affected by unknown CVE via apollo-server-micro (>=1.4.0 <=2.14.1)

apollo-server-micro NPM version =1.4.0, =1.0.1, =1.0.2, =1.0.0, =1.0.0, =2.0.0, =1.5.8, =0.1.0, =0.1.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

Introspection in schema validation in Apollo Server

We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions. Impact If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not...

@aifedespaix/fdp-api-libs (=1.0.7), @jovercao/egg-graphql (>=0.1.0 <=0.1.13) +1 more potentially affected by unknown CVE via apollo-server-cache-memcached (=0.6.7)

apollo-server-cache-memcached NPM version =0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-server-cache-memcached and may be impacted: - @aifedespaix/fdp-api-libs =1.0.7 - @jovercao/egg-graphql =0.1.0, =0.0.58-alpha.6, =0.0.58-alpha.17...

@aerogear/voyager-metrics (>=0.7.2-dev.409.01ecc9f.0 <=0.7.2-dev.411.7aaa5a6.0), @aerogear/voyager-server (>=0.7.2-dev.409.01ecc9f.0 <=0.9.1-dev.430.0433c35.0) +41 more potentially affected by unknown CVE via apollo-server (>=0.1.5 <=2.14.1)

apollo-server NPM version =0.1.5, =0.7.2-dev.409.01ecc9f.0, =0.7.2-dev.409.01ecc9f.0, =2018.8.28-0, =1.0.0, =0.10.0, =0.0.9, =0.0.11, =2.0.0-rc.15, =0.0.0, =1.3.1, =4.0.0-alpha-0b0eefe.499, =4.0.1-beta.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@bakjs/graphql (>=2.0.0 <=2.2.0), @clevyr/pavo-hapi-graphql (>=0.0.1 <=0.0.5) +14 more potentially affected by unknown CVE via apollo-server-hapi (>=1.2.0 <=1.4.0)

apollo-server-hapi NPM version =1.2.0, =2.0.0, =0.0.1, =0.1.0, =1.0.0, =0.0.51, =3.0.0, =1.0.2, =1.0.1, =0.2.2, =0.2.37 - trailpack-apollo =3.0.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@axelspringer/mango-api (>=0.0.1-alpha <=1.0.0-beta.75), @carlosbajo/graphql-gateway (>=1.2.0 <=2.3.6) +39 more potentially affected by unknown CVE via apollo-server-koa (>=1.3.6 <=2.0.4)

apollo-server-koa NPM version =1.3.6, =0.0.1-alpha, =1.2.0, =2.8.1, =0.2.1, =0.2.6, =0.1.2, =6.1.0, =1.0.1, =0.0.9, =0.0.1, =1.0.3, =1.0.0, =2.8.1, =1.0.0, =1.4.56 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

apollo-magazine.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1164096 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Cross-site Scripting (XSS)

github.com/ctripcorp/apollo is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the variable valueWithHiddenChars in showHiddenChars function in item-modal-directive.js, allowing a malicious user to inject and execute malicious web scripts...