directus vulnerabilities (npm)
58 vulnerabilities.
-
directusnpm Directus: Authorization-dependent response served from unsegmented cache key 8.6 High -
directusnpm Directus: SSRF Protection Bypass via 0.0.0.0 in File Import 7.7 High -
directusnpm Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries 8.1 High -
directusnpm Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver 7.5 High -
directusnpm Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits 6.5 Medium -
directusnpm Directus exposes sensitive fields in revision history 6.5 Medium -
directusnpm Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite 7.1 High -
directusnpm Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import 7.7 High -
directusnpm Directus GraphQL Schema SDL Disclosure Setting 5.3 Medium -
directusnpm Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow 6.1 Medium -
directusnpm Directus is an Open Redirect in Admin 2FA Setup Page 4.3 Medium -
directusnpm Directus has a Path Traversal and Broken Access Control in File Management API 8.5 High -
directusnpm Directus is Missing Cross-Origin Opener Policy 8.7 High -
directusnpm Directus Affected by User Enumeration via Password Reset Timing Attack 5.3 Medium -
directusnpm Directus has open redirect in SAML 4.3 Medium -
directusnpm Directus Vulnerable to Information Leakage in Existing Collections 4.3 Medium -
directusnpm Directus Vulnerable to Stored Cross-site Scripting 5.5 Medium -
directusnpm Directus has Improper Permission Handling on Deleted Fields 4.6 Medium -
directusnpm Directus's conceal fields are searchable if read permissions enabled 6.5 Medium -
directusnpm Directus allows unauthenticated file upload and file modification due to lacking input sanitization 9.3 Critical -
directusnpm Directus missing permission checks for manual trigger Flows 6.5 Medium -
directusnpm Directus's exact version number is exposed by the OpenAPI Spec 5.3 Medium -
directusnpm Directus doesn't redact tokens in Flow logs 4.5 Medium -
directusnpm Directus doesn't redact sensitive user data when logging via event hooks 4.2 Medium -
directusnpm Directus's webhook trigger flows can leak sensitive data 8.6 High -
directusnpm Directus `search` query parameter allows enumeration of non permitted fields 5.3 Medium -
directusnpm Suspended Directus user can continue to use session token to access API 3.5 Low -
directusnpm Directus's S3 assets become unavailable after a burst of HEAD requests 5.3 Medium -
directusnpm Directus's S3 assets become unavailable after a burst of malformed transformations 5.3 Medium -
directusnpm Overlapping policies allow update to non-allowed fields in directus 5.4 Medium -
directusnpm Directus privilege escalation vulnerability using Share feature 5.0 Medium -
directusnpm Directus allows unauthenticated access to WebSocket events and operations 7.5 High -
directusnpm Directus has an HTML Injection in Comment 5.7 Medium -
directusnpm SSRF Loopback IP filter bypass in directus 5.0 Medium -
directusnpm Directus's session is cached for OpenID and OAuth2 if `redirect` is not used 7.4 High -
directusnpm Directus 10.13.0 - Insecure object reference via PATH presets 4.3 Medium -
directusnpm Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options 5.4 Medium -
directusnpm Directus allows SSO User Enumeration 7.5 High -
directusnpm Directus Incorrectly handles _in` filter 6.3 Medium -
directusnpm Directus is soft-locked by providing a string value to random string util 7.5 High -
directusnpm Directus Lacks Session Tokens Invalidation 5.4 Medium -
directusnpm Directus allows redacted data extraction on the API through "alias" 4.9 Medium -
directusnpm Session Token in URL in directus 2.3 Low -
directusnpm URL Redirection to Untrusted Site in OAuth2/OpenID in directus 5.4 Medium -
directusnpm Directus version number disclosure 5.3 Medium -
directusnpm Directus MySQL accent insensitive email matching 8.2 High -
directusnpm Directus crashes on invalid WebSocket message 5.9 Medium -
directusnpm Directus affected by VM2 sandbox escape vulnerability 7.6 High -
directusnpm Directus has Incorrect Permission Checking for GraphQL Subscriptions 5.7 Medium -
directusnpm Directus API vulnerable to denial of service 6.5 Medium - Show olderLoading…