4769 matches found
GraphQL Armor Max-Depth Plugin Bypass via fragment caching
Summary A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details In the countDepth function, we have the following code that calculates the depth of a used fragment: typescript...
GHSA-224P-V68G-5G8F GraphQL Armor Max-Depth Plugin Bypass via fragment caching
Summary A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details In the countDepth function, we have the following code that calculates the depth of a used fragment: typescript...
Allocation of Resources Without Limits or Throttling
Overview @escape.tech/graphql-armor-max-depth is a Limit the depth allowed in a GraphQL query. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the countDepth function when the ignoreIntrospection configuration is enabled. An attacker ca...
@cedarjs/api-server (>=0.0.4, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=9.0.0-canary.3124) +54 more potentially affected by unknown CVE via @escape.tech/graphql-armor-max-depth (>=2.0.0, <=2.4.1)
@escape.tech/graphql-armor-max-depth NPM version =2.0.0, =0.0.4, =5.0.7-next.219, =0.0.4, =5.0.4-next.167, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.9.1-next.19, =6.0.3-next.227, =0.0.4, =6.0.3-next.227, =0.0.4, =9.0.0-canary.3124 and more Source cves: unknown CVE Source advisory:...
GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
@cedarjs/api-server (>=0.0.4, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=9.0.0-canary.3124) +54 more potentially affected by unknown CVE via @escape.tech/graphql-armor-max-depth (>=2.0.0, <=2.4.1)
@escape.tech/graphql-armor-max-depth NPM version =2.0.0, =0.0.4, =5.0.7-next.219, =0.0.4, =5.0.4-next.167, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.9.1-next.19, =6.0.3-next.227, =0.0.4, =6.0.3-next.227, =0.0.4, =9.0.0-canary.3124 and more Source cves: unknown CVE Source advisory:...
GHSA-HMFR-RX46-4JX2 GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
PT-2025-36601
Summary A query depth restriction using the max-depth can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details In the countDepth function, we have the following code that calculates the depth of a used fragment: typescript...
PT-2025-36624
Summary A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the countDepth function, we have the following check for the ignoreIntrospection option...
Linux Distros Unpatched Vulnerability : CVE-2024-4006
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all...
Linux Distros Unpatched Vulnerability : CVE-2025-5846
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed...
Linux Distros Unpatched Vulnerability : CVE-2025-27407
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21,...
Linux Distros Unpatched Vulnerability : CVE-2024-8116
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific...
Linux Distros Unpatched Vulnerability : CVE-2021-22228
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14...
Linux Distros Unpatched Vulnerability : CVE-2022-0172
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction fo...
Malicious code in @zalastax/nolb-graphql-e (npm)
The package @zalastax/nolb-graphql-e was found to contain malicious code...
Malicious code in @zalastax/nolb-graphql-f (npm)
The package @zalastax/nolb-graphql-f was found to contain malicious code...
Malicious code in @zalastax/nolb-graphql-r (npm)
The package @zalastax/nolb-graphql-r was found to contain malicious code...