@5minds/processcube_engine (>=15.0.0 <=17.0.0-renovate-fffeda-lowoukm9), @alphaapps/nestjs-auth (>=1.0.0 <=1.2.2) +237 more potentially affected by CVE-2023-6293 via sequelize-typescript (>=0.3.5 <=2.1.5)

sequelize-typescript NPM version =0.3.5, =15.0.0, =1.0.0, =4.4.6-alpha.2, =12.1.0-alpha.6, =0.0.1, =0.1.0, =0.1.3-alpha.0, =0.1.3-alpha.0, =0.1.0-alpha.0, =0.1.1-alpha.0, =0.1.11-alpha.0, =0.0.1, =0.0.1-alpha.14 and more Source cves: CVE-2023-6293 Source advisory: OSV:GHSA-7PVX-4585-HQWW...

GHSA-7PVX-4585-HQWW sequelize-typescript Prototype Pollution vulnerability

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

sequelize-typescript security vulnerability

sequelize-typescript is a set of decorators and other methods for sequelize. A security vulnerability exists in sequelize-typescript versions prior to 2.1.6, which stems from the presence of prototype contamination...

SQL Injection

sequelize is vulnerable to SQL Injection. The vulnerability exists because the library does not properly escape the query strings in the replacement parameter used in the where clause, allowing an attacker to inject and execute malicious SQL queries...

GHSA-F598-MFPV-GMFX Sequelize - Default support for “raw attributes” when using parentheses

Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL ts User.findAll attributes: 'countid', 'count' ; Produced sql SELECT countid AS "count" FROM "users" Patches This feature was deprecated i...

Sequelize - Default support for “raw attributes” when using parentheses

Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL ts User.findAll attributes: 'countid', 'count' ; Produced sql SELECT countid AS "count" FROM "users" Patches This feature was deprecated i...

@galenjs/framework-next (>=1.0.0 <=1.7.0), @galenjs/models (>=1.1.11 <=1.7.0) +4 more potentially affected by CVE-2023-22578 via @sequelize/core (=7.0.0-alpha.10)

@sequelize/core NPM version =7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22578 Source...

12g (=0.0.27), 1st-project (=1.0.2) +2908 more potentially affected by CVE-2023-22578 via sequelize (>=1.0.2 <=6.28.2)

sequelize NPM version =1.0.2, =0.0.1, =0.0.2, =0.0.1, =1.2.3, =1.0.0, =0.5.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =2.0.1 - @aapokiiso/hsl-congestion-route-pattern-repository =1.0.0 and more Source cves: CVE-2023-22578 Source advisory: OSV:GHSA-F598-MFPV-GMFX...

12g (=0.0.27), 1st-project (=1.0.2) +2906 more potentially affected by CVE-2023-22579 via sequelize (>=1.0.2 <=6.28.0)

sequelize NPM version =1.0.2, =0.0.1, =0.0.2, =0.0.1, =1.2.3, =1.0.0, =0.5.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =2.0.1 - @aapokiiso/hsl-congestion-route-pattern-repository =1.0.0 and more Source cves: CVE-2023-22579 Source advisory: OSV:GHSA-VQFX-GJ96-3W95...

@galenjs/framework-next (>=1.0.0 <=1.7.0), @galenjs/models (>=1.1.11 <=1.7.0) +4 more potentially affected by CVE-2023-22579 via @sequelize/core (=7.0.0-alpha.10)

@sequelize/core NPM version =7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22579 Source...

Unsafe fall-through in getWhereConditions

Impact Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error. A finder call like the following did not throw an error: ts User.findAll where: new Date, ; As this option is typically used with plain javascript objects, be awar...

GHSA-VQFX-GJ96-3W95 Unsafe fall-through in getWhereConditions

Impact Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error. A finder call like the following did not throw an error: ts User.findAll where: new Date, ; As this option is typically used with plain javascript objects, be awar...

12g (=0.0.27), 1st-project (=1.0.2) +2825 more potentially affected by CVE-2023-25813 via sequelize (>=1.0.2 <=6.19.0)

sequelize NPM version =1.0.2, =0.0.1, =0.0.2, =0.0.1, =1.2.3, =1.0.0, =0.5.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =2.0.1 - @aapokiiso/hsl-congestion-route-pattern-repository =1.0.0 and more Source cves: CVE-2023-25813 Source advisory: OSV:GHSA-WRH9-CJV3-2HPW...

GHSA-WRH9-CJV3-2HPW Sequelize vulnerable to SQL Injection via replacements

Impact The SQL injection exploit is related to replacements. Here is such an example: In the following query, some parameters are passed through replacements, and some are passed directly through the where option. typescript User.findAll where: or literal'soundex"firstName" = soundex:firstName',...

Sequelize vulnerable to SQL Injection via replacements

Impact The SQL injection exploit is related to replacements. Here is such an example: In the following query, some parameters are passed through replacements, and some are passed directly through the where option. typescript User.findAll where: or literal'soundex"firstName" = soundex:firstName',...

CVE-2023-25813

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...

Sql injection

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...

CVE-2023-25813 SQL Injection via replacements in sequelize

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...