PT-2022-16542 · Unknown · Feathers-Sequelize +1

Name of the Vulnerable Software and Affected Versions: Feathers js library affected versions not specified Description: The issue is related to improper input validation in the Feathers js library, which can lead to a SQL injection attack on the back-end database when the feathers-sequelize packa...

CVE-2022-2422 Feathers - SQL injection via attribute aliases

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

CVE-2022-2422

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

The vulnerability of the sequelize.json() ORM library for applications like Sequelize allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the sequelize.json ORM library for applications like Sequelize is related to the lack of protection for SQL query structures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected informati...

Risks involved with operatorAliases in Sequelize

The risks involved with the operatorAliases option in Sequelize, the popular library for DBMSs The post Risks involved with operatorAliases in Sequelize appeared first on Wallarm Blog...

Denial of Service in sequelize

Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service DoS. The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces...

@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +109 more potentially affected by unknown CVE via sequelize (>=4.0.0, <=4.44.3)

sequelize NPM version =4.0.0, =0.0.1, =4.0.2, =1.0.16, =1.0.20, =1.0.18, =1.0.10, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =1.0.6-2ef3451f-b17, =5.1.3, =1.6.7, =0.6.3, =0.6.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-FW4P-36J9-RRJ3...

GHSA-FW4P-36J9-RRJ3 Denial of Service in sequelize

Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service DoS. The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces...

PT-2020-21285

Name of the Vulnerable Software and Affected Versions sequelize versions prior to 4.44.4 Description The issue affects the SQLite dialect, which fails to catch a TypeError exception for the results variable. If the results value is undefined, it may trigger an error on a .map call, potentially...

SQL Injection via GeoJSON in sequelize

Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using STGeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText...

GHSA-5V9H-Q3GJ-C32X SQL Injection via GeoJSON in sequelize

Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using STGeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText...

@loke/mysql-orm (1.12.0), @starboard/models (>=3.0.0, <=3.0.1) +51 more potentially affected by CVE-2016-1000225 via sequelize (>=3.4.1, <=3.23.4)

sequelize NPM version =3.4.1, =3.0.0, =2.0.2, =0.0.1, =0.0.1, =2.0.0-alpha.1, =1.0.2, =0.1.0, =2.8.0, =0.0.1, =10.0.2, =1.0.1, =0.5.2, =0.0.1, =1.2.7 and more Source cves: CVE-2016-1000225 Source advisory: OSV:GHSA-5V9H-Q3GJ-C32X...

PT-2020-7933

Name of the Vulnerable Software and Affected Versions: sequelize versions prior to 3.23.6 Description: The issue affects models with fields of the GEOMETRY DataType, leading to SQL Injection. This occurs because single quotes in document values are not properly escaped for GeoJSON documents using...

SQL Injection in sequelize

Versions of sequelize prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation Upgrade to version 3.35.1 or later...

@aaa-backend-stack/graphql (>=1.16.1, <=2.4.4), @aaa-backend-stack/graphql-rest-bindings (>=1.16.0, <=1.16.9) +114 more potentially affected by CVE-2019-10749 via sequelize (>=3.0.1, <=3.34.0)

sequelize NPM version =3.0.1, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.12.0, =1.0.22, =2.0.10, =1.0.97, =1.6.489, =1.6.735 and more Source cves: CVE-2019-10749 Source advisory: OSV:GHSA-2598-2F59-RMHQ...

GHSA-2598-2F59-RMHQ SQL Injection in sequelize

Versions of sequelize prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation Upgrade to version 3.35.1 or later...

GHSA-J9XP-92VC-559J SQL Injection in sequelize

Affected versions of sequelize are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation If you are using sequelize 5.x, upgrade to version...

@aaa-backend-stack/graphql (>=1.16.1, <=2.4.4), @aaa-backend-stack/graphql-rest-bindings (>=1.16.0, <=1.16.9) +114 more potentially affected by CVE-2019-10748 via sequelize (>=3.0.1, <=3.34.0)

sequelize NPM version =3.0.1, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.12.0, =1.0.22, =2.0.10, =1.0.97, =1.6.489, =1.6.735 and more Source cves: CVE-2019-10748 Source advisory: OSV:GHSA-J9XP-92VC-559J...

@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +108 more potentially affected by CVE-2019-10748 via sequelize (>=4.0.0, <=4.44.2)

sequelize NPM version =4.0.0, =0.0.1, =4.0.2, =1.0.16, =1.0.20, =1.0.18, =1.0.10, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =1.0.6-2ef3451f-b17, =5.1.3, =1.6.7, =0.6.3, =0.6.5 and more Source cves: CVE-2019-10748 Source advisory: OSV:GHSA-J9XP-92VC-559J...

@essential-projects/sequelize_connection_manager (>=3.0.0-7a12b2e-b1, <=3.0.0-df349f85-b6), @nelreina/node-sequelize (>=3.5.3, <=3.5.5) +26 more potentially affected by CVE-2019-10748 via sequelize (>=5.0.0-beta.11, <=5.8.10)

sequelize NPM version =5.0.0-beta.11, =3.0.0-7a12b2e-b1, =3.5.3, =4.0.0-beta.2, =10.0.0-004477d6-b2, =6.0.0-54bba797-b2, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =1.1.5, =5.4.0, =5.4.0, =5.4.1 and more Source cves: CVE-2019-10748 Source advisory: OSV:GHSA-J9XP-92VC-559J...