CVE-2023-34235

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235

Strapi (pre-4.10.8) is vulnerable to information disclosure due to a Knex query that allows changing the default field prefix (t(number)). If the t-number prefix is used, private fields like password can be exposed, as t1.password is not protected. The issue can lead to filtering attacks affectin...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

Leaking sensitive user information still possible by filtering on private with prefix fields

Summary Still able to leak private fields if using the tnumber prefix Details Knex query allows you to change there default prefix SqliteError: select distinct t0. from pages as t0 left join adminusers as t1 on t0.updatedbyid = t1.id where t1.password = 1 so if you change the prefix to the same a...

GHSA-9XG4-3QFM-9W8F Leaking sensitive user information still possible by filtering on private with prefix fields

Summary Still able to leak private fields if using the tnumber prefix Details Knex query allows you to change there default prefix SqliteError: select distinct t0. from pages as t0 left join adminusers as t1 on t0.updatedbyid = t1.id where t1.password = 1 so if you change the prefix to the same a...

Strapi 信息泄露漏洞

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.10.8, which stems from a Knex query that allows a user to change the default prefix, which may disclose private fields if the tnumber prefix is used...

PT-2023-24759

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.10.8 Description The issue allows for the leakage of private fields when using the tnumber prefix. This is possible because the Knex query allows users to change the default prefix. For example, changing the prefix t...

GHSA-CRHG-XGRG-VVCC a12nserver vulnerable to potential SQL Injections via Knex dependency

Impact Users of a12nserver that use MySQL might be vulnerable to SQL injection bugs. If you use a12nserver and MySQL, update as soon as possible. This SQL injection bug might let an attacker obtain OAuth2 Access Tokens for users unrelated to those that permitted OAuth2 clients. Patches The knex...

a12nserver vulnerable to potential SQL Injections via Knex dependency

Impact Users of a12nserver that use MySQL might be vulnerable to SQL injection bugs. If you use a12nserver and MySQL, update as soon as possible. This SQL injection bug might let an attacker obtain OAuth2 Access Tokens for users unrelated to those that permitted OAuth2 clients. Patches The knex...

@athenna/database (>=1.2.2, <=1.4.6), @aws-amplify/amplify-appsync-simulator (2.9.4-rdsv2preview.0) +141 more potentially affected by CVE-2016-20018 via knex (>=2.0.0, <=2.3.0)

knex NPM version =2.0.0, =1.2.2, =4.2.0-rds-v2.3, =10.5.3-rds-v2.0, =11.1.2-sync-fix.0 - @aws-amplify/graphql-auth-transformer 1.2.6-rdsv2preview.0 - @aws-amplify/graphql-default-value-transformer 0.7.8-rdsv2preview.0 - @aws-amplify/graphql-function-transformer 0.7.36-rdsv2preview.0 and more Sour...

CVE-2016-20018

CVE-2016-20018 : Knex.js (project Knex) up to version 2.3.0 contains a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. The connected IBM/NVD listing confirms the vulnerability and CVSS details (HIGH severity, basic score 7.5). The available sou...

Stripe: Object injection in `stripe-billing-typographic` GitHub project via /auth/login

An object injection vulnerability was discovered in the stripe-billing-typographic GitHub project, which allowed an attacker to bypass authentication and perform a SQL injection attack. The vulnerability was caused by a dependency called sqlstring, which mishandled objects in queries. The impact ...

63pokupki-nodejs-common (0.0.2), @63pokupki/nodejs-common (>=0.0.2, <=0.0.85) +1436 more potentially affected by CVE-2019-10757 via knex (>=0.1.8, <=0.19.4)

knex NPM version =0.1.8, =0.0.2, =1.0.10, =0.0.1, =4.0.0, =0.0.1, =0.1.0, =0.0.1, =0.2.0, =0.1.0, =0.1.1, =0.5.0 and more Source cves: CVE-2019-10757 Source advisory: OSV:GHSA-58V4-QWX5-7F59...

SQL Injection in knex

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB...

GHSA-58V4-QWX5-7F59 SQL Injection in knex

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB...

SQL Injection

knex is vulnerable to SQL injection. The vulnerability exists as identifiers are incorrectly escaped if MSSQL is used...

SQL Injection

Overview knex is a query builder for PostgreSQL, MySQL and SQLite3 Affected versions of this package are vulnerable to SQL Injection. None Remediation Upgrade knex to version 0.19.5 or higher. References - GitHub Commit - GitHub PR Credit: Snyk Security Research Team...

63pokupki-nodejs-common (0.0.2), @63pokupki/nodejs-common (>=0.0.2, <=0.0.85) +1436 more potentially affected by CVE-2019-10757 via knex (>=0.1.8, <=0.19.4)

knex NPM version =0.1.8, =0.0.2, =1.0.10, =0.0.1, =4.0.0, =0.0.1, =0.1.0, =0.0.1, =0.2.0, =0.1.0, =0.1.1, =0.5.0 and more Source cves: CVE-2019-10757 Source advisory: SNYK:JS-KNEX-471962...