EUVD-2019-0645

Malware in sbrugna...

CVE-2019-15658

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...

SQL Injection

Overview Versions of connect-pg-simple are vulnerable to SQL Injection. The PGStore.prototype.quotedTable function allows for the query to be manipulated if the input has double quotes through the schemaName or tableName variables. These variables are passed to the constructor and are unlikely to...

connect-pg-simple SQL Injection Vulnerability

connect-pg-simple is a PostgreSQL session store module. A SQL injection vulnerability exists in connect-pg-simple versions prior to 6.0.1, which can be exploited by an attacker to execute illegal SQL commands...

SQL Injection

connect-pg-simple is vulnerable to SQL injection. SQL queries with schemaName or tableName are not sanitized, allowing an attacker to inject and execute malicious SQL...

CVE-2019-15658

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...

CVE-2019-15658

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...

Sql injection

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...

CVE-2019-15658

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...

CVE-2019-15658

The CVE-2019-15658 entry concerns the npm package connect-pg-simple (PostgreSQL session store). Affected versions prior to 6.0.1 are vulnerable to SQL injection when tableName or schemaName are untrusted inputs. The root cause is in PGStore.prototype.quotedTable, which uses those variables to bui...

GHSA-XQH8-5J36-4556 SQL Injection in connect-pg-simple

Impact An unlikely SQL injection if the case of an unsanitized table name input. Patches The user should upgrade to 6.0.1. Due to its low impact a backport has not been made to the 5.x branch. Workarounds If there is no likelihood that the tableName or schemaName options sent to the constructor...

CVE-2019-15658: Improper Neutralization of Special Elements used in an SQL Command

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...