npm

directus

60 Total advisories

60 Vulnerabilities

0 Malware

Dependency scanning

Check whether directus is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

directus

Vulnerabilities

Directus version number disclosure

Directus Lacks Session Tokens Invalidation

Session Token in URL in directus

Directus vulnerable to extraction of password hashes through export querying

directus vulnerable to HTML Injection in Password Reset email to custom Reset URL

Directus's webhook trigger flows can leak sensitive data

Directus `search` query parameter allows enumeration of non permitted fields

Directus's S3 assets become unavailable after a burst of HEAD requests

Directus has a DOM-Based cross-site scripting (XSS) via layout_options

Directus: Authorization-dependent response served from unsegmented cache key

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Directus: Sensitive fields exposed in revision history

Directus: Path Traversal and Broken Access Control in File Management API

Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

Directus: Open Redirect in Admin 2FA Setup Page

Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits

Directus: GraphQL Schema SDL Disclosure Setting

Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow

Directus: Missing Cross-Origin Opener Policy

Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver

Directus Vulnerable to User Enumeration via Password Reset Timing Attack

Incorrect Permission Checking for GraphQL Subscriptions

Directus has open redirect in SAML

Directus has an HTML Injection in Comment

Session is cached for OpenID and OAuth2 if `redirect` is not used

Directus Vulnerable to Information Leakage in Existing Collections

Directus's conceal fields are searchable if read permissions enabled

Directus is Vulnerable to Stored Cross-site Scripting

Directus has Improper Permission Handling on Deleted Fields

Directus incorrectly handles `_in` filter

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows

Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged

Directus' exact version number is exposed by the OpenAPI Spec

Directus tokens are not redacted in flow logs, exposing session credentials to all admin

Suspended Directus user can continue to use session token to access API

Insecure default value for CORS configuration

Directus's S3 assets become unavailable after a burst of malformed transformations

Duplicate Advisory: Code injection in Directus

Directus has an insecure object reference via PATH presets

Duplicate Advisory: Improper access control in Directus

Directus allows updates to non-allowed fields due to overlapping policies

Directus allows privilege escalation using Share feature

Directus allows unauthenticated access to WebSocket events and operations

Directus vulnerable to SSRF Loopback IP filter bypass

Directus Allows Single Sign-On User Enumeration

Directus is soft-locked by providing a string value to random string util

Directus allows redacted data extraction on the API through "alias"

URL Redirection to Untrusted Site in OAuth2/OpenID in directus

Directus has MySQL accent insensitive email matching

Directus crashes on invalid WebSocket message

directus vulnerable to Insertion of Sensitive Information into Log File

Directus vulnerable to Server-Side Request Forgery On File Import

Directus vulnerable to unhandled exception on illegal filename_disk value

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

Server-Side Request Forgery in Directus

Directus API vulnerable to denial of service

Directus affected by VM2 sandbox escape vulnerability

Browse more npm advisories

Start Securing