Priority LOW 27
Hasura is an open-source product that provides users GraphQL or REST APIs.
Vulnerabilities
8 records
TI-2021-22365 CVE-2021-47748 · GHSA-4v6h-qhxp-2wqw
Hasura GraphQL 1.3.3 - Remote Code Execution
Priority HIGH 81
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation.
TI-2021-22332 CVE-2021-47715 · GHSA-8p9c-w6fc-vjgh
Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection
Priority LOW 37
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint.
TI-2021-22331 CVE-2021-47714 · GHSA-rghc-mxjc-cmxr
Hasura GraphQL 1.3.3 Local File Read via SQL Injection
Priority HIGH 70
Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint.
TI-2021-22330 CVE-2021-47713 · GHSA-c963-4j6g-xhmv
Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query
Priority HIGH 77
Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields.
Priority MEDIUM 41
Hasura is an open-source product that provides users GraphQL or REST APIs.
TI-2022-23138 CVE-2022-46792 · GHSA-jfv6-7jf3-3v86
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many…
Priority MEDIUM 42
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends.
TI-2019-16093 CVE-2019-1020015 · GHSA-xgqc-x32m-2j5c
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
Priority LOW 35
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.