@vendure/core vulnerabilities (npm)
7 vulnerabilities.
-
@vendure/corenpm Vendure: Shop API list queries can return non-public entities when filterOperator is OR 5.3 Medium -
@vendure/corenpm Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification 9.1 Critical -
@vendure/corenpm Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends 7.5 High -
@vendure/corenpm @vendure/core has a SQL Injection vulnerability 9.1 Critical -
@vendure/corenpm Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy 2.7 Low -
@vendure/corenpm @vendure/core's insecure currencyCode handling allows wrong payment amounts 5.3 Medium -
@vendure/corenpm Vendure Cross Site Request Forgery vulnerability impacting all API requests No score