PT-2020-13458 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered that involves an insufficient check in the GraphQL API. This issue allows a maintainer to delete a...

HackerOne: Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation

Summary: Hacker can bypass minimum bounty amount restrictions in invitation preferences due to trusted client-side input to UpdateInvitationPreferencesMutation GraphQL operation Description: The new "Bounty Preferences" feature at https://hackerone.com/settings/preferences allows the hacker to se...

Shopify: A staff member with no permissions can edit Store Customer Email

Impact A staff member with no permissions can edit a store Customer email which they have no access to. This is the email that the store customers will see when emailing them. Details emailSenderConfigurationUpdate is an undocumented GraphQL API that will allows a malicious staff member in a stor...

HackerOne: Team object in GraphQL disclosed private_comment

Summary: Hi Team, Some privateI think part of GraphQL reveals to us Steps To Reproduce Without authorization 1. https://hackerone.com/graphql POST: "query":"query nodeid: \"gid://hackerone/SurveyRatingItem/█████\" ... on...

@anacoelhovicente/primecore (=0.3.4-beta.1-webhook), @axonish/core (>=0.2.0 <=0.3.0) +29 more potentially affected by unknown CVE via type-graphql (>=0.12.3 <=0.17.5)

type-graphql NPM version =0.12.3, =0.2.0, =0.0.2, =1.0.0, =1.0.0, =0.0.5, =0.0.1, =0.0.0-4d6c2e0, =0.1.0, =0.3.0-alpha.1, =0.0.1, =5.2.0, =0.0.1, =0.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XF64-2F9P-6PQQ...

GHSA-XF64-2F9P-6PQQ Information Exposure in type-graphql

Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request. Recommendation Upgrade to version 0.17.6 or later...

Information Exposure in type-graphql

Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request. Recommendation Upgrade to version 0.17.6 or later...

GHSA-HX78-272P-MQQH Authorization Bypass in graphql-shield

Versions of graphql-shield prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option nocache relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have...

Authorization Bypass in graphql-shield

Versions of graphql-shield prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option nocache relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have...

@atto-byte/yoga (>=0.6.0 <=0.6.6), @britishcouncil/grizzly (>=0.1.0 <=0.3.3) +22 more potentially affected by unknown CVE via graphql-shield (>=3.2.5 <=5.7.3)

graphql-shield NPM version =3.2.5, =0.6.0, =0.1.0, =1.0.2-alpha.11, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.0.6, =0.0.0, =0.0.1, =1.0.0, =0.0.5, =0.0.1, =0.0.2 - ustart =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-HX78-272P-MQQH...

@blackbaud-bobbyearl/skyux-builder (>=1.10.0 <=1.10.1), @blackbaud/skyux-builder (>=1.10.1 <=1.31.0) +72 more potentially affected by unknown CVE via lodash.mergewith (>=4.0.3 <=4.6.0)

lodash.mergewith NPM version =4.0.3, =1.10.0, =1.10.1, =5.0.0, =5.2.8, =5.0.0, =5.0.0, =5.1.1, =1.3.0, =1.0.0-alpha.1, =1.0.4, =1.1.3, =1.0.0, =1.1.11, =1.0.3, =1.0.0, =1.0.0-alpha.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5947-M4FG-XHQG...

Insecure Default Configuration in graphql-code-generator

Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process. Recommendation Upgrade to version 0.18.2 ...

@absa-subatomic/openshift-api (>=0.0.1 <=0.0.2), @atomist-seeds/empty-sdm (>=1.0.0-atomist-update-branch-master-20190328081334.20190328081445 <=1.0.0-master.20190328082132) +24 more potentially affected by unknown CVE via graphql-code-generator (>=0.10.7 <=0.17.0)

graphql-code-generator NPM version =0.10.7, =0.0.1, =1.0.0-atomist-update-branch-master-20190328081334.20190328081445, =0.3.7, =1.0.2, =1.1.0, =0.1.2, =0.1.0-master.20190213110409, =1.0.3-atomist-update-branch-master-1543218569607.20181126075034, =1.0.0-master.20190215080022, =1.0.0, =0.11.10,...

GHSA-9W87-4J72-GCV7 Insecure Default Configuration in graphql-code-generator

Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process. Recommendation Upgrade to version 0.18.2 ...

GitLab: Able to leak private email of any user given his/her username via graphql

Summary Graphql query user is leaking private email of users query userusername:"" email username Steps to reproduce Step-by-step guide to reproduce the issue, including: Have a account with private email settings Use graphql query to access the private email query userusername:"" email username...

New Relic: Getting API access key Through Introspection query Graphql

The introspection query should only be allowed internally and should not be allowed to the general public. If we can fetch the entire back-end API documentation and calls available on a server then that can be very dangerous is many cases what if we could get our hands on some API calls only mean...

Shopify: Password protection can be removed for newly created development store

Details Per https://help.shopify.com/en/partners/dashboard/managing-stores/development-storesthe-development-store-password-page, it states that the password can only be removed once the store has been transferred or switch to a paid plan. You can remove the password page only after you transfer...

HackerOne: Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted

Hi team, I don't know your policy about pentestersabout their visibility on the platform, But I couldn't find any other pentesters before. 1 For example: GraphQL has the h1pentester attribute that would explicitly point us to the pentester, but if we make a query, it doesn't reveal the pentester ...

HackerOne: Graphql: Sorting the reports by jira_status field resulted to different value

Summary: Sorting the reports by jirastatus yield to different result depicting the team is using jira even the user has no access. Description: A user with no access to jira information of any reports can somehow access the jira field using orderby through jirastatus Using the 2 graphql below we...

LY Corporation: Deleting someone else's profile image with a GraphQL query in programming education service (https://entry.line.me)

LINE entry is a service that provides programming education for children https://entry.line.me. LINE entry provides users with the ability to add profile images. It was possible to delete other people's profile images or thumbnails using a GraphQL query...