GHSA-8XPJ-9J9G-FC9R SQL Injection in elide-datastore-aggregation

Impact When leveraging the following together: - Elide Aggregation Data Store for Analytic Queries - Parameterized Columns A column that requires a client provided parameter - A parameterized column of type TEXT There is the potential for a hacker to provide a carefully crafted query that would...

Elide Authorization Issues Vulnerability

Elide is a self-contained API for web and mobile applications written in Java. An authorization issue vulnerability exists in versions of Elide prior to 4.5.14. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a networked system or product...

CVE-2020-5289

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The...

CVE-2020-5289

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The...

Design/Logic Flaw

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The...

CVE-2020-5289

In Elide before 4.5.14, an adversary can infer the value of a model field they cannot access by crafting client-side filter expressions to reveal presence/absence of models in a collection, effectively reconstructing the inaccessible field. This arises from read-permission checks not enforcing co...

CVE-2020-5289 Read permissions not enforced for client provided filter expressions in Elide http client

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The...

com.spotify:apollo-elide (>=0.0.1 <=0.0.3), com.yahoo.elide:dropwizard-elide (>=2.3.0 <=3.2.2) +17 more potentially affected by CVE-2020-5289 via com.yahoo.elide:elide-core (>=1.0.0.1 <=4.5.13)

com.yahoo.elide:elide-core MAVEN version =1.0.0.1, =0.0.1, =2.3.0, =1.0.0.8, =1.0.0.6, =1.0.0.6, =1.0.0.6, =4.4.0, =1.0.0.6, =3.0.0, =4.5.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =4.0-beta-1, =4.5.12, =4.5.13 and more Source cves: CVE-2020-5289 Source advisory: OSV:GHSA-2MXR-89GF-RC4V...