Exploit for SQL Injection in Sequelizejs Sequelize

CVE-2023-25813 CVE 정보 - CVE 번호: CVE-2023-25813https...

blackwood-systems.com Cross Site Scripting vulnerability OBB-3842583

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Prototype Pollution

sequelize-typescript is vulnerable to Prototype Pollution. The vulnerability is due to the deepAssign function which does not check if the attribute resolves to the object prototype and hence it is possible to create attributes that exist on every object, or replace critical attributes with...

GHSA-7PVX-4585-HQWW sequelize-typescript Prototype Pollution vulnerability

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @andresmeidla/crud-sequelize (>=5.0.0-alpha.3, <=5.0.1-alpha-7) +75 more potentially affected by CVE-2023-6293 via sequelize-typescript (>=2.0.0, <=2.1.5)

sequelize-typescript NPM version =2.0.0, =15.0.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.2, =0.1.3, =0.1.9, =0.4.3, =0.1.7, =0.1.3, =0.1.0, =3.10.6, =3.10.10 and more Source cves: CVE-2023-6293 Source advisory: OSV:GHSA-7PVX-4585-HQ...

CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

sequelize-typescript security vulnerability

sequelize-typescript is a set of decorators and other methods for sequelize. A security vulnerability exists in sequelize-typescript versions prior to 2.1.6, which stems from the presence of prototype contamination...

SQL Injection

sequelize is vulnerable to SQL Injection. The vulnerability exists because the library does not properly escape the query strings in the replacement parameter used in the where clause, allowing an attacker to inject and execute malicious SQL queries...

Sequelize - Default support for “raw attributes” when using parentheses

Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL ts User.findAll attributes: 'countid', 'count' ; Produced sql SELECT countid AS "count" FROM "users" Patches This feature was deprecated i...

GHSA-F598-MFPV-GMFX Sequelize - Default support for “raw attributes” when using parentheses

Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL ts User.findAll attributes: 'countid', 'count' ; Produced sql SELECT countid AS "count" FROM "users" Patches This feature was deprecated i...

@24hr/content-next (>=1.0.0, <=2.1.17-alpha), @24hr/natswrapper (>=1.0.0, <=1.0.20) +276 more potentially affected by CVE-2023-22578 via sequelize (>=6.0.0-beta.4, <=6.28.2)

sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =1.0.0, =1.0.43, =0.13.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =0.1.3-alpha.0, =0.1.3-alpha.0, =0.3.2 and more Source cves: CVE-2023-22578 Source advisory: OSV:GHSA-F598-MFPV-GMFX...

Unsafe fall-through in getWhereConditions

Impact Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error. A finder call like the following did not throw an error: ts User.findAll where: new Date, ; As this option is typically used with plain javascript objects, be awar...

@24hr/content-next (>=1.0.0, <=2.1.17-alpha), @24hr/natswrapper (>=1.0.0, <=1.0.20) +274 more potentially affected by CVE-2023-22579 via sequelize (>=6.0.0-beta.4, <=6.28.0)

sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =1.0.0, =1.0.43, =0.13.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =0.1.3-alpha.0, =0.1.3-alpha.0, =0.3.2 and more Source cves: CVE-2023-22579 Source advisory: OSV:GHSA-VQFX-GJ96-3W95...

GHSA-VQFX-GJ96-3W95 Unsafe fall-through in getWhereConditions

Impact Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error. A finder call like the following did not throw an error: ts User.findAll where: new Date, ; As this option is typically used with plain javascript objects, be awar...

@24hr/content-next (>=1.0.0, <=2.1.17-alpha), @24hr/natswrapper (>=1.0.0, <=1.0.20) +205 more potentially affected by CVE-2023-25813 via sequelize (>=6.0.0-beta.4, <=6.19.0)

sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =1.0.43, =0.13.0, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =0.1.3-alpha.0, =0.1.3-alpha.0, =0.1.0-alpha.0, =0.1.1-alpha.0, =0.3.0 and more Source cves: CVE-2023-25813 Source advisory: OSV:GHSA-WRH9-CJV3-2HPW...

GHSA-WRH9-CJV3-2HPW Sequelize vulnerable to SQL Injection via replacements

Impact The SQL injection exploit is related to replacements. Here is such an example: In the following query, some parameters are passed through replacements, and some are passed directly through the where option. typescript User.findAll where: or literal'soundex"firstName" = soundex:firstName',...

Sequelize vulnerable to SQL Injection via replacements

Impact The SQL injection exploit is related to replacements. Here is such an example: In the following query, some parameters are passed through replacements, and some are passed directly through the where option. typescript User.findAll where: or literal'soundex"firstName" = soundex:firstName',...

CVE-2023-25813

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...

Sql injection

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...