PT-2020-21212

Name of the Vulnerable Software and Affected Versions @hapi/accept versions prior to 3.2.4 or 5.0.1 Description The Accept-Encoding HTTP header parser in @hapi/accept has a Denial of Service issue. If the header contains certain invalid values, it causes the function to throw a system error. Sinc...

PT-2020-21127

Name of the Vulnerable Software and Affected Versions hapi versions affected versions not specified Description The issue affects the CORS request handler in hapi, which can cause a system error when encountering invalid values in the header. If an unhandled exception handler is not available, th...

PT-2020-20946

Name of the Vulnerable Software and Affected Versions @hapi/hapi versions prior to 18.4.1 @hapi/hapi versions prior to 19.1.1 Description The issue affects the CORS request handler, which can throw a system error if the header contains invalid values. If there is no unhandled exception handler,...

PT-2020-21028

Name of the Vulnerable Software and Affected Versions @hapi/subtext versions prior to 6.1.2 Description The issue allows attackers to send requests with arbitrary payload sizes, potentially exhausting system resources and leading to Denial of Service. This is due to the failure to enforce the...

be-more-hapi (1.0.0-rc.1.1), kazana-server (3.0.0) +2 more potentially affected by CVE-2015-9243 via hapi (>=11.0.1, <=11.1.2)

hapi NPM version =11.0.1, =0.1.94, =0.1.129 Source cves: CVE-2015-9243 Source advisory: GHSA-J3G2-M5JJ-6336...

GHSA-J3G2-M5JJ-6336 Unsafe Merging of CORS Configuration Conflict in hapi

Versions of hapi prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended. Recommendation Update hapi to version...

be-more-hapi (1.0.0-rc.1.1), kazana-server (3.0.0) +2 more potentially affected by CVE-2015-9243 via hapi (>=11.0.1, <=11.1.2)

hapi NPM version =11.0.1, =0.1.94, =0.1.129 Source cves: CVE-2015-9243 Source advisory: OSV:GHSA-J3G2-M5JJ-6336...

Unsafe Merging of CORS Configuration Conflict in hapi

Versions of hapi prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended. Recommendation Update hapi to version...

butchershop (0.1.0-pre), grunt-butchershop (0.2.1) +2 more potentially affected by CVE-2014-4671 via hapi (6.0.2)

hapi NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on hapi and may be impacted: - butchershop 0.1.0-pre - grunt-butchershop 0.2.1 - hapi-level =0.0.3, =0.0.7 - rutha-utils 0.1.0 Source cves: CVE-2014-4671 Source advisory:...

GHSA-363H-VJ6Q-3CMJ Rosetta-Flash JSONP Vulnerability in hapi

This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. Recommendation - Update hapi to version 6.1.1...

butchershop (0.1.0-pre), grunt-butchershop (0.2.1) +2 more potentially affected by CVE-2014-4671 via hapi (6.0.2)

hapi NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on hapi and may be impacted: - butchershop 0.1.0-pre - grunt-butchershop 0.2.1 - hapi-level =0.0.3, =0.0.7 - rutha-utils 0.1.0 Source cves: CVE-2014-4671 Source advisory:...

Rosetta-Flash JSONP Vulnerability in hapi

This description taken from the pull request provided by Patrick Kettner. Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy. Recommendation - Update hapi to version 6.1.1...

br.com.simpli:simpli-sql (3.1.2), ca.uhn.hapi:hapi-sourcegen (>=1.1-beta2, <=2.3) +239 more potentially affected by CVE-2019-2692 via mysql:mysql-connector-java (5.1.6)

mysql:mysql-connector-java MAVEN version 5.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - br.com.simpli:simpli-sql 3.1.2 - ca.uhn.hapi:hapi-sourcegen =1.1-beta2, =1.1-beta2, =0.0.3, =0.0.2, =1.1,...

Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...

PT-2020-17846

Name of the Vulnerable Software and Affected Versions graphql-playground-html versions prior to 1.6.22 graphql-playground-middleware-express versions prior to 1.7.16 graphql-playground-middleware-koa versions prior to 1.6.15 graphql-playground-middleware-lambda versions prior to 1.7.17...

CVE-2020-4038: Improper Neutralization of Input During Web Page Generation

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...

Information Exposure

Overview Versions of apollo-server-hapi prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...

@instacarro/ic-model-admin (>=2.0.5, <=2.0.8), grommet-toolbox (>=0.1.3, <=0.2.12) +4 more potentially affected by CVE-2020-7605 via gulp-tape (>=0.0.3, <=1.0.0)

gulp-tape NPM version =0.0.3, =2.0.5, =0.1.3, =0.1.1, =0.1.5, =0.43.2 - sp-router-js 1.0.1 Source cves: CVE-2020-7605 Source advisory: SNYK:JS-GULPTAPE-560124...

Node.js third-party modules: Prototype pollution in multipart parsing

I would like to report a prototype pollution attack in fastify-multipart it allows to crash a remote server parsing multipart requests by sending a specially crafted request. Module module name: fastify-multipart version: all versions before Detailed steps to reproduce with all required...

Denial Of Service (DoS)

@hapi/ammo is vulnerable to denial of service DoS. The Range HTTP header parser causes the function to throw a system error when the header value is invalid, allowing an attacker to crash the application using a malicious header value...