8 matches found
Malware in @onereach/billing-dto
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Improper Handling of Insufficient Privileges
Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges via the FileItemDTO component. An attacker can access metadata of files and sub-folders in any folder, including id, type, name, and other fields, by sending authenticated web service queries...
com.graphaware:neo4j-dto (0.1), com.graphaware:neo4j-relcount (1.2) +9 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.9)
org.neo4j:neo4j MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.graphaware:neo4j-dto 0.1 - com.graphaware:neo4j-relcount 1.2 - com.graphaware:neo4j-tx-event-api 0.1 - com.graphaware:neo4j-uti...
Automatic named constructor discovery in Valinor
Design issue - automatic constructor discovery The issue arises when upgrading from cuyz/valinor:0.3.0 to a newer system on an existing application, which broke due to the wrong constructor being picked. Still, a bigger security concern is problematic, and it is akin to...
GHSA-XHR8-MPWQ-2RR2 Automatic named constructor discovery in Valinor
Design issue - automatic constructor discovery The issue arises when upgrading from cuyz/valinor:0.3.0 to a newer system on an existing application, which broke due to the wrong constructor being picked. Still, a bigger security concern is problematic, and it is akin to...
com.graphaware:neo4j-dto (>=1.9-1.0, <=1.9-1.2), com.graphaware:neo4j-framework (1.9-1.1) +9 more potentially affected by CVE-2021-34371 via org.neo4j:neo4j (1.9.1)
org.neo4j:neo4j MAVEN version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.graphaware:neo4j-dto =1.9-1.0, =1.9-1.0, =1.9-1.2, =1.9-1.3 - org.neo4j.app:neo4j-server 1.9.1 -...
Sql injection
The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and desc parameters...
