CVE-2023-28877

The VTEX [email protected] GraphQL API module does not properly restrict unauthorized access to private configuration data. [email protected] is unaffected by this issue...

CVE-2023-28877

The VTEX [email protected] GraphQL API module does not properly restrict unauthorized access to private configuration data. [email protected] is unaffected by this issue...

Information disclosure

The VTEX email protected GraphQL API module does not properly restrict unauthorized access to private configuration data. email protected is unaffected by this issue...

Denial Of Services (DoS)

graphql-java is vulnerable to Denial Of Services DoS. An attacker can send a maliciously crafted GraphQL query that causes excessive stack consumption, which can lead to an application crash...

CVE-2023-28877

The CVE concerns the VTEX [email protected] GraphQL API module, where unauthorized access to private configuration data is not properly restricted. The issue affects [email protected]; [email protected] is unaffected. The root cause is insufficient access controls exposing private configuration data...

VTEX apps-graphql security vulnerabilities

VTEX apps-graphql is a graphql API module for VTEX IO applications from VTEX UK. A security vulnerability exists in the VTEX [email protected] GraphQL API module that stems from not properly restricting unauthorized access to private configuration data...

Stud42 vulnerable to denial of service

Stud42's API is vulnerable to a denial of service because the API pod can be overloaded by the GraphQL parser...

PT-2023-22027

Name of the Vulnerable Software and Affected Versions VTEX apps-graphql versions 2.x Description The VTEX apps-graphql GraphQL API module does not properly restrict unauthorized access to private configuration data. Recommendations For VTEX apps-graphql versions 2.x, consider upgrading to version...

PT-2023-32969 · S42.App · S42.App

Name of the Vulnerable Software and Affected Versions: s42.app affected versions not specified Description: A security issue has been identified in the GraphQL parser used by the API of s42.app, allowing an attacker to overload the parser and cause the API pod to crash. By sending a specially...

CVE-2023-28877: Improper Access Control

The VTEX [email protected] GraphQL API module does not properly restrict unauthorized access to private configuration data. [email protected] is unaffected by this issue...

CVE-2023-28877

The VTEX [email protected] GraphQL API module does not properly restrict unauthorized access to private configuration data. [email protected] is unaffected by this issue...

CVE-2023-28877

The VTEX [email protected] GraphQL API module does not properly restrict unauthorized access to private configuration data. [email protected] is unaffected by this issue...

CVE-2023-28867

A flaw was found in GraphQL Java. This issue may allow a malicious user to send a crafted GraphQL query that causes stack consumption, causing a denial of service...

GHSA-P4QX-6W5P-4RJ2 GraphQL Java vulnerable to stack consumption

In GraphQL Java aka graphql-java before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.0, <=6.4.7) +325 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=19.0, <=19.3)

com.graphql-java:graphql-java MAVEN version =19.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =2.0.4, =14.3.0, =17.5.0 - com.datasqrl:sqrl-base 0.6.0 - com.datasqrl:sqrl-calcite 0.6.0 and more Source cves: CVE-2023-28867 Source advisory: OSV:GHSA-P4QX-6W5P-4RJ2...

com.atlassian:nadel (>=2022-01-19t23-18-30-adbad461, <=2023-03-23t00-25-09-43ae18bf), com.atlassian:nadel-api (>=2022-01-19t23-18-30-adbad461, <=2022-03-22t05-05-01-a5d0b804) +4 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=0.0.0-2021-06-27t12-22-33-cd2bab76, <=0.0.0-2022-10-29t03-41-04-bb4a3b2b)

com.graphql-java:graphql-java MAVEN version =0.0.0-2021-06-27t12-22-33-cd2bab76, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-04-05t04-35-54-29b76c29 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.2.5) +822 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=1.3, <=17.4)

com.graphql-java:graphql-java MAVEN version =1.3, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.0.0, =6.0.0, =6.0.3, =0.1.0, =1.0.0, =2.8.5, =1.3.0, =1.1.0, =2.27.0 and more Source cves: CVE-2023-28867 Source advisory: OSV:GHSA-P4QX-6W5P-4RJ2...

com.atlassian:nadel (>=2022-01-19t23-18-30-adbad461, <=2023-03-23t00-25-09-43ae18bf), com.atlassian:nadel-api (>=2022-01-19t23-18-30-adbad461, <=2022-03-22t05-05-01-a5d0b804) +4 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=0.0.0-2021-06-27t12-22-33-cd2bab76, <=0.0.0-2022-10-29t03-41-04-bb4a3b2b)

com.graphql-java:graphql-java MAVEN version =0.0.0-2021-06-27t12-22-33-cd2bab76, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-01-19t23-18-30-adbad461, =2022-04-05t04-35-54-29b76c29 -...

cn.asany.chaos:jfantasy-graphql (>=2.10.0, <=2.11.0), com.apollographql.federation:federation-graphql-java-support (>=2.0.2, <=2.0.3) +222 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=18.0, <=18.3)

com.graphql-java:graphql-java MAVEN version =18.0, =2.10.0, =2.0.2, =6.0.0-alpha.6, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =0.1.11, =1.0.1 and more Source cves: CVE-2023-28867...

cn.asany.chaos:jfantasy-graphql (>=2.10.0, <=2.11.0), com.apollographql.federation:federation-graphql-java-support (>=2.0.2, <=2.0.3) +222 more potentially affected by CVE-2023-28867 via com.graphql-java:graphql-java (>=18.0, <=18.3)

com.graphql-java:graphql-java MAVEN version =18.0, =2.10.0, =2.0.2, =6.0.0-alpha.6, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =6.0.0-alpha.1, =0.1.11, =1.0.1 and more Source cves: CVE-2023-28867...