487 matches found
GHSA-HXWC-5VW9-2W4W NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later...
PT-2020-21354
Name of the Vulnerable Software and Affected Versions loopback-connector-mongodb versions prior to 3.6.0 Description The issue arises from the lack of proper sanitization of filters passed to the database query, leading to NoSQL Injection. This allows for the execution of code on the database...
GHSA-F5CV-XRV9-R8W7 NoSQL injection in express-cart
Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which...
NoSQL injection in express-cart
Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which...
@bnabli/wisejs (>=0.0.1, <=0.0.17), @connectonume/ume-module-schemas (>=0.2.0, <=1.5.1) +159 more potentially affected by unknown CVE via mongoose (>=4.0.0, <=4.3.5)
mongoose NPM version =4.0.0, =0.0.1, =0.2.0, =2.0.0, =0.0.0, =0.1.0, =0.1.1, =1.0.0, =0.0.1, =0.0.1, =1.5.0-beta.4, =1.6.0-beta.1 - brisk-mongodb 0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R5XW-Q988-826M...
PT-2020-21263
Name of the Vulnerable Software and Affected Versions express-cart versions prior to 1.1.8 Description The issue is caused by the lack of user input sanitization in the login handlers, allowing NoSQL injection. Specifically, parameters from the JSON body are sent directly into the MongoDB query,...
GitHub Security Lab: Golang : Add MongoDb NoSQL injection sinks
This bug was reported directly to GitHub Security Lab...
CVE-2020-5251
In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way...
3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +273 more potentially affected by CVE-2019-17426 via mongoose (>=5.0.0, <=5.7.4)
mongoose NPM version =5.0.0, =0.24.0, =0.0.1, =0.0.2, =1.0.33, =1.0.1, =1.0.1, =1.0.9, =6.5.1, =0.1.8, =3.2.9, =3.4.11 - @codate/email 3.1.0 and more Source cves: CVE-2019-17426 Source advisory: OSV:GHSA-8687-VV9J-HGPH...
NoSQL Injection in sequelize
Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later...
GHSA-WFP9-VR4J-F49J NoSQL Injection in sequelize
Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later...
GHSA-M734-R4G6-34F9 NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the special $where...
NoSQL Injection in loopback-connector-mongodb
Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the special $where...
@colmena/api (0.1.0), agneta-platform (>=0.13.0-beta.1, <=0.13.0-beta.9) +1 more potentially affected by unknown CVE via loopback-connector-mongodb (>=3.1.0, <=3.2.1)
loopback-connector-mongodb NPM version =3.1.0, =0.13.0-beta.1, =0.13.0-beta.9 - scheduler-service-api 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M734-R4G6-34F9...
PT-2019-20075
Name of the Vulnerable Software and Affected Versions sequelize versions prior to 4.12.0 Description The issue affects the sequelize library, where query operators such as $gt are not properly sanitized. This may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendations...
NoSQL Injection
Overview Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later References - GitHub Issue - Snyk...
How to Attack and Defend a Prosthetic Arm
The IoT world has long since grown beyond the now-ubiquitous smartwatches, smartphones, smart coffee machines, cars capable of sending tweets and Facebook posts and other stuff like fridges that send spam. Today's IoT world now boasts state-of-the-art solutions that quite literally help people...
NoSQL Injection
Overview Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later. References -...
