Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 61
Reset filtersDirectus's webhook trigger flows can leak sensitive data
Directus `search` query parameter allows enumeration of non permitted fields
Suspended Directus user can continue to use session token to access API
Directus's S3 assets become unavailable after a burst of HEAD requests
Directus's S3 assets become unavailable after a burst of malformed transformations
Directus allows updates to non-allowed fields due to overlapping policies
Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Directus allows privilege escalation using Share feature
Directus allows unauthenticated access to WebSocket events and operations
Directus has an HTML Injection in Comment
Directus vulnerable to SSRF Loopback IP filter bypass
Session is cached for OpenID and OAuth2 if `redirect` is not used
Directus has an insecure object reference via PATH presets
Directus Allows Single Sign-On User Enumeration
Directus GraphQL Field Duplication Denial of Service (DoS)
Directus incorrectly handles `_in` filter
Directus Blind SSRF On File Import
Directus is soft-locked by providing a string value to random string util
Directus Lacks Session Tokens Invalidation
Directus allows redacted data extraction on the API through "alias"
URL Redirection to Untrusted Site in OAuth2/OpenID in directus
Session Token in URL in directus
Directus version number disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.