Cross-site scripting in @shopify/koa-shopify-auth

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

GHSA-JQH7-W5PR-CR56 Cross-site scripting in @shopify/koa-shopify-auth

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Open redirect

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

koa-remove-trailing-slashes 输入验证错误漏洞

koa-remove-trailing-slashes is an application. A Koa middleware that removes trailing slashes from paths. A security vulnerability exists in versions prior to koa-remove-trailing-slashes 2.0.2 that stems from vulnerability to Open Redirect...

@medley/medley (>=0.11.0, <=0.12.1), @nova/azure-functions (>=0.3.0, <=0.3.3) +1 more potentially affected by CVE-2020-7764 via find-my-way (>=2.0.1, <=2.1.0)

find-my-way NPM version =2.0.1, =0.11.0, =0.3.0, =1.0.0, =1.1.0 Source cves: CVE-2020-7764 Source advisory: OSV:GHSA-JGRH-5M3H-9C5F...

@medley/medley (>=0.11.0, <=0.12.1), @nova/azure-functions (>=0.3.0, <=0.3.3) +1 more potentially affected by CVE-2020-7764 via find-my-way (>=2.0.1, <=2.1.0)

find-my-way NPM version =2.0.1, =0.11.0, =0.3.0, =1.0.0, =1.1.0 Source cves: CVE-2020-7764 Source advisory: SNYK:JS-FINDMYWAY-1038269...

GHSA-X45V-PVPG-HCRH Malicious Package in mysql-koa

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

Malicious Package in koa-body-parse

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

GHSA-WQGQ-MFVJ-6QXP Malicious Package in koa-body-parse

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

cnpmjs.org (>=2.0.0-beta0, <=2.0.0-rc.3), json2html-cli (>=0.0.2, <=0.0.8) +1 more potentially affected by CVE-2014-10065 via remarkable (1.3.0)

remarkable NPM version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on remarkable and may be impacted: - cnpmjs.org =2.0.0-beta0, =0.0.2, =0.0.8 - koa-markdown 1.0.0 Source cves: CVE-2014-10065 Source advisory: OSV:GHSA-F9VC-Q3HH-QHFV...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

Cross site scripting

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2020-8176

CVE-2020-8176 affects koa-shopify-auth, versions 3.1.61–3.1.62. The vulnerability is an XSS via the shop parameter in /shopify/auth/enable_cookies. Root cause cited across sources is lack of sanitization of the shop value in multiple files (e.g., auth/client/request-storage-access.ts, auth/client...

Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...

Information Disclosure

apollo-server-koa is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

Information Exposure

Overview Versions of apollo-server-koa prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...

@carlosbajo/graphql-gateway (>=2.3.10, <=2.4.62), @egg-type-graphql/egg-graphql (>=2.8.1, <=2.8.3) +19 more potentially affected by unknown CVE via apollo-server-koa (>=2.0.4, <=2.9.12)

apollo-server-koa NPM version =2.0.4, =2.3.10, =2.8.1, =2.4.8, =0.2.1, =0.5.1, =0.2.1, =0.5.1, =0.2.6, =0.1.2, =0.1.6, =0.3.10, =0.3.10, =2.3.7, =2.8.1, =2.8.2 - @openpracticelibrary/strapi-plugin-graphql 3.0.0-beta.20.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...