com.github.t1:wunderbar.demo.product (>=3.0, <=3.2), io.github.chains-project:maven-lockfile-github-action (>=1.0.1, <=4.2.1) +21 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.14.0.final, <=3.5.2)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.14.0.final, =3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =2.1.0 and more Source cves: CVE-2023-6394https://vu...

CVE-2023-6394

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

Authentication flaw

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

CVE-2023-6394 Quarkus: graphql operations over websockets bypass

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

CVE-2023-6394 Quarkus: graphql operations over websockets bypass

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

CVE-2023-6394

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

CVE-2023-6394 Quarkus: graphql operations over websockets bypass

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

com.github.t1:wunderbar.demo.product (>=3.0, <=3.2), io.github.chains-project:maven-lockfile-github-action (>=1.0.1, <=4.2.1) +21 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.14.0.final, <=3.5.2)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.14.0.final, =3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =2.1.0 and more Source cves: CVE-2023-6394https://vu...

CVE-2023-6394

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

CVE-2023-6394: Missing Authorization

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

Quarkus Security Vulnerabilities

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus that stems from when a request is received via websocket and role-based permissions are not specified on a GraphQL operation, Quarkus processes the request without...

quarkus: GraphQL operations over WebSockets bypass

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and...

CVE-2023-47643

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

Authentication flaw

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

CVE-2023-47643

The SuiteCRM Customer Relationship Management software is vulnerable to unauthenticated GraphQL Introspection in versions prior to 8.4.2 . The root cause is that introspection is enabled without authentication, allowing an attacker to obtain the GraphQL schema and map the entire API attack surfac...

CVE-2023-47643

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

CVE-2023-47643 SuiteCRM has Unauthenticated Graphql Introspection Enabled

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

CVE-2023-47643 SuiteCRM has Unauthenticated Graphql Introspection Enabled

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

CVE-2023-47643 SuiteCRM has Unauthenticated Graphql Introspection Enabled

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...