5915 matches found
GraphCrawler - GraphQL Automated Security Testing Toolkit
Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e' option and Graphinder will do subdomain enumeration + search popular...
CVE-2022-36084
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...
Code injection
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...
CVE-2022-36084
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses "@flexSearchFulltext", users of that schema may be able to inject arbitrary AQL...
CVE-2022-36084
Summary of CVE-2022-36084 : The vulnerability affects cruddl (GraphQL API schema generator). If a schema uses the directive @flexSearchFulltext and cruddl is used with versions before 2.7.0 or 3.0.2, an attacker with READ permission on at least one root entity type that has @flexSearchFulltext en...
CVE-2022-36084 cruddl vulnerable to AQL injection through flexSearch
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL...
Integrating API Security and WAF into K8s Kong API Gateway
Article by Jiju Jacob, Director of Engineering at Revenera This is an update of Mr. Jacobs’ 05/23 post in his Medium blog. He is a Director of Engineering at Revenera. Revenera, born as InstallShield and now a Flexera company, helps software and technology companies use open source solutions more...
CVE-2022-1902
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
CVE-2022-1902
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
Design/Logic Flaw
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
CVE-2022-1902
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
CVE-2022-1902
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
CVE-2022-1902
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
CVE-2022-1902
CVE-2022-1902 describes a vulnerability in Red Hat Advanced Cluster Security for Kubernetes where Notifier secrets were not properly sanitized in the GraphQL API. This allows authenticated ACS users to retrieve Notifiers via GraphQL, potentially escalating privileges. CVSSv3.1 base score 8.8 (HIG...
CVE-2022-1902: Exposure of Sensitive System Information to an Unauthorized Control Sphere
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...
io.automatiko.addons:automatiko-graphql-addon (0.18.0), io.quarkus:quarkus-smallrye-graphql-deployment (>=2.11.1.final, <=2.12.0.cr1) potentially affected by CVE-2022-2466 via io.quarkus:quarkus-smallrye-graphql (>=2.11.1.final, <=2.12.0.cr1)
io.quarkus:quarkus-smallrye-graphql MAVEN version =2.11.1.final, =2.11.1.final, =2.12.0.cr1 Source cves: CVE-2022-2466 Source advisory: MEND:CVE-2022-2466...
io.automatiko.addons:automatiko-graphql-addon (0.17.0), io.quarkus:quarkus-smallrye-graphql-deployment (>=2.10.0.final, <=2.10.3.final) potentially affected by CVE-2022-2466 via io.quarkus:quarkus-smallrye-graphql (>=2.10.0.final, <=2.10.3.final)
io.quarkus:quarkus-smallrye-graphql MAVEN version =2.10.0.final, =2.10.0.final, =2.10.3.final Source cves: CVE-2022-2466 Source advisory: MEND:CVE-2022-2466...
GO-2022-0942 Infinite recursion in parser in github.com/graphql-go/graphql
graphql-go aka GraphQL for Go has infinite recursion in the type definition parser...
