Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
228 results · page 5 of 5
May 4, 2022Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash.CVE-2022-30288 · Other software · ohler · reported by MITREHigh 7.5
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
- Product
- agoo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort.CVE-2022-24827 · Other software · yahoo · reported by GitHubHigh 8.1
Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.
- Product
- elide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022graphql-go is a GraphQL server with a focus on ease of use.CVE-2022-21708 · Other software · graph-gophers · reported by GitHubMedium 6.5
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.
- Product
- graphql-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Mercurius is a GraphQL adapter for Fastify.CVE-2021-43801 · Other software · mercurius-js · reported by GitHubHigh 7.5
Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler.
- Product
- mercurius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.CVE-2021-39915 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 beCVE-2021-39904 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation.CVE-2021-41248 · Other software · graphql · reported by GitHubHigh 7.1
GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than graphiql@1.4.7 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a vulnerable schema in graphiql. There are a number of ways that can occur. By default, the schema URL is not attacker-controllable in graphiql or in its suggested implementations or examples, leaving only very complex attack vectors. If a custom implementation of graphiql's fetcher allows the schema URL to be set dynamically, such as a URL query parameter like ?endpoint= in graphql-playground, or a database provided value, then this custom graphiql implementation is vulnerable to phishing attacks, and thus much more readily available, low or no privelege level xss attacks. The URLs could look like any generic looking graphql schema URL. It should be noted that desktop clients such as Altair, Insomnia, Postwoman, do not appear to be impacted
- Product
- graphiql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021GraphQL Playground is a GraphQL IDE for development of graphQL focused applications.CVE-2021-41249 · Other software · graphql · reported by GitHubHigh 7.1
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.
- Product
- graphql-playground
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2021Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.CVE-2021-28661 · Other software · Silverstripe · reported by MITREMedium 4.3
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsilverstripe.org
Sep 1, 2021Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mCVE-2021-36012 · Websites & servers · Adobe · reported by AdobeMedium 6.5
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 7, 2021A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mCVE-2021-22224 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.1
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an CVE-2021-35970 · Other software · Voxmedia · reported by MITREHigh 7.5
Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.
- Product
- Coral Talk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.coralproject.netgithub.com
Jun 8, 2021In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.CVE-2020-26136 · Other software · Silverstripe · reported by MITREMedium 6.5
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Mar 2, 2021An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify tCVE-2021-22863 · Other software · GitHub · reported by product-cna@github.comHigh 8.1
An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.12.22 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Jan 20, 2021This affects the package @graphql-tools/git-loader before 6.2.6.CVE-2021-23326 · Other software · The-guild · reported by report@snyk.ioMedium 6.3
This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
- Product
- Graphql-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netgithub.com
Dec 10, 2020Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership.CVE-2020-26417 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API.CVE-2020-26415 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2020In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and CVE-2020-15126 · Other software · parse-community · reported by GitHubMedium 6.5
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2020**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allCVE-2020-9483 · Websites & servers · Apache · reported by security@apache.orgHigh 7.5
**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.
- Product
- Skywalking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2020GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability.CVE-2020-4038 · Other software · prisma-labs · reported by GitHubHigh 7.4
GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.
- Product
- graphql-playground
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2020GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.CVE-2020-10978 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Feb 19, 2020In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,CVE-2019-12437 · Other software · Silverstripe · reported by MITREHigh 8.8
In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Nov 26, 2019An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries.CVE-2019-18455 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Jul 29, 2019graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.CVE-2019-1020015 · Other software · graphql-engine · reported by josh@bress.netHigh 7.5
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
- Product
- graphql-engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2019The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' iCVE-2019-9881 · WordPress plugins & themes · reported by MITREMedium 5.3
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Affected
- 0.2.3 to 0.2.3
- What to do
- Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 10, 2019An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress.CVE-2019-9880 · WordPress plugins & themes · reported by MITRECritical 9.1
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
- Affected
- 0.2.3 to 0.2.3
- What to do
- Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 10, 2019The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed.CVE-2019-9879 · WordPress plugins & themes · reported by MITRECritical 9.8
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
- Affected
- 0.2.3 to 0.2.3
- What to do
- Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 4, 2019API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to CVE-2019-1000011 · Other software · Api-platform · reported by MITREMedium 6.5
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.