THREATIST.IORead the docs 9 records
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository.
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application.
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks.
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies.
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking.
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session.