directus
Directus is a real-time API and App dashboard for managing SQL database content
Security Advisories for directus in npm
High
about 2 months ago
Directus: Authorization-dependent response served from unsegmented cache key
npm
directus
High
5 months ago
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
npm
directus
High
5 months ago
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
npm
directus
Moderate
5 months ago
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
npm
directus
High
5 months ago
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
npm
directus
High
5 months ago
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
npm
directus
Moderate
5 months ago
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
npm
directus
High
5 months ago
Directus: Path Traversal and Broken Access Control in File Management API
npm
directus
Moderate
7 months ago
Directus Vulnerable to User Enumeration via Password Reset Timing Attack
npm
@directus/api, directus
Moderate
10 months ago
Directus Vulnerable to Information Leakage in Existing Collections
npm
@directus/api, directus
Moderate
10 months ago
Directus's conceal fields are searchable if read permissions enabled
npm
@directus/api, directus
Critical
about 1 year ago
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
npm
@directus/api, directus
Moderate
about 1 year ago
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
npm
directus
Moderate
about 1 year ago
Directus' exact version number is exposed by the OpenAPI Spec
npm
directus
Moderate
about 1 year ago
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
npm
directus
Moderate
about 1 year ago
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
npm
directus
Potential
Moderate
over 1 year ago
Directus inserts access token from query string into logs
npm
@directus/api
Moderate
over 1 year ago
Directus `search` query parameter allows enumeration of non permitted fields
npm
directus
Low
over 1 year ago
Suspended Directus user can continue to use session token to access API
npm
@directus/types, @directus/api, directus
Moderate
over 1 year ago
Directus's S3 assets become unavailable after a burst of HEAD requests
npm
directus, @directus/storage-driver-s3
Moderate
over 1 year ago
Directus's S3 assets become unavailable after a burst of malformed transformations
npm
directus, @directus/storage-driver-s3
Moderate
over 1 year ago
Directus allows updates to non-allowed fields due to overlapping policies
npm
@directus/api, directus
Low
over 1 year ago
Directus has a DOM-Based cross-site scripting (XSS) via layout_options
npm
directus
High
over 1 year ago
Directus allows unauthenticated access to WebSocket events and operations
npm
@directus/api, directus
Moderate
almost 2 years ago
Directus vulnerable to SSRF Loopback IP filter bypass
npm
@directus/api, directus
High
almost 2 years ago
Session is cached for OpenID and OAuth2 if `redirect` is not used
npm
@directus/api, directus
Potential
Potential
High
over 2 years ago
Directus is soft-locked by providing a string value to random string util
npm
directus
Moderate
over 2 years ago
Directus allows redacted data extraction on the API through "alias"
npm
directus
Moderate
over 2 years ago
URL Redirection to Untrusted Site in OAuth2/OpenID in directus
npm
directus
Moderate
over 3 years ago
directus vulnerable to Insertion of Sensitive Information into Log File
npm
directus
Moderate
over 3 years ago
Directus vulnerable to extraction of password hashes through export querying
npm
directus
High
over 3 years ago
directus vulnerable to HTML Injection in Password Reset email to custom Reset URL
npm
directus
Moderate
over 3 years ago
Directus vulnerable to Server-Side Request Forgery On File Import
npm
directus
Moderate
about 4 years ago
Directus vulnerable to unhandled exception on illegal filename_disk value
npm
directus
High
over 4 years ago
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
npm
directus