@vendure/core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 7 advisory(ies) without a verdict
Advisories (7)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-6f65-4fv2-wwch Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy | < 3.5.3 | Undetermined |
| GHSA-6j36-r6pr-59x4 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification | < 3.7.0 | Undetermined |
| GHSA-9pp3-53p2-ww9v @vendure/core has a SQL Injection vulnerability | 3.0.0 – < 3.5.7 ; 3.6.0 – < 3.6.2 ; 1.7.4 – < 2.3.4 | Undetermined |
| GHSA-h9wq-xcqx-mqxm Vendure Cross Site Request Forgery vulnerability impacting all API requests | < 2.0.3 | Undetermined |
| GHSA-jgm3-qmp2-c4p7 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends | < 3.6.5 | Undetermined |
| GHSA-wm63-7627-ch33 @vendure/core's insecure currencyCode handling allows wrong payment amounts | < 2.1.3 | Undetermined |
| GHSA-xf65-r35x-wmmv Vendure: Shop API list queries can return non-public entities when filterOperator is OR | 1.0.0 – < 3.6.5 | Undetermined |
Sources
| Source | Licence |
|---|