Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
neo4j/neo4j-ogm
master @ eeee0bc
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
DeleteDelegate.java: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Data Destruction: A logical flaw in resolving entity labels during a 'deleteAll' operation can result in the generation of unconstrained delete statements, leading to accidental database-wide data erasure. Developers must ensure that lack of a resolvable label aborts the transaction early.
Information Disclosure: Embedded user credentials in connection URIs can be exposed through configuration getters or logging frameworks if they are not systematically stripped before serialization or output.
Information Disclosure: Configuration properties storing the connection URI can inadvertently persist or log raw credentials if they are not explicitly sanitized when setting properties or printing configuration dumps.