@directus/api vulnerabilities (npm)
12 vulnerabilities.
-
@directus/apinpm Directus Affected by User Enumeration via Password Reset Timing Attack 5.3 Medium -
@directus/apinpm Directus has open redirect in SAML 4.3 Medium -
@directus/apinpm Directus Vulnerable to Information Leakage in Existing Collections 4.3 Medium -
@directus/apinpm Directus's conceal fields are searchable if read permissions enabled 6.5 Medium -
@directus/apinpm Directus allows unauthenticated file upload and file modification due to lacking input sanitization 9.3 Critical -
@directus/apinpm Suspended Directus user can continue to use session token to access API 3.5 Low -
@directus/apinpm Overlapping policies allow update to non-allowed fields in directus 5.4 Medium -
@directus/apinpm Directus allows unauthenticated access to WebSocket events and operations 7.5 High -
@directus/apinpm Directus inserts access token from query string into logs 4.2 Medium -
@directus/apinpm SSRF Loopback IP filter bypass in directus 5.0 Medium -
@directus/apinpm Directus's session is cached for OpenID and OAuth2 if `redirect` is not used 7.4 High -
@directus/apinpm Directus has a Blind SSRF On File Import 5.0 Medium