458 matches found
CVE-2023-25813 SQL Injection via replacements in sequelize
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...
CVE-2023-25813
Sequelize (Node.js ORM) prior to v6.19.1 is vulnerable to SQL injection when using replacements in combination with where clauses, due to improper escaping and the replacement processing order. The issue affects Sequelize
PT-2023-20322 · Sequelize · Sequelize
Name of the Vulnerable Software and Affected Versions: Sequelize versions prior to 6.19.1 Description: The issue is related to SQL injection due to improper escaping of parameters passed through replacements. This can lead to arbitrary SQL injection depending on the specific queries in use. For...
Sequelize SQL注入漏洞
Sequelize is a database ORM Object Relational Mapping tool for Node.js. A security vulnerability exists in Sequelize versions prior to 6.19.1, which stems from an SQL injection vulnerability due to not properly escaping parameters...
Information Disclosure
sequelize is vulnerable to Information Disclosure. A remote unauthenticated attacker is able to inject malicious queries due to improper input filtering, resulting in the disclosure of sensitive information...
Type Confusion
sequelize is vulnerable to Type Confusion. A remote attacker is able to inject malicious content due to improper parameter filtering, which results in type confusion, leading to code injection...
SQL Injection
sequelize is vulnerable to SQL Injection attacks. A specifically crafted attack statement through query-generator.js allows a malicious user to inject and execute arbitrary SQL queries on the target system due to improper attribute filtering...
GHSA-R3VQ-92C6-3MQF Duplicate advisory: Sequelize - Unsafe fall-through in getWhereConditions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vqfx-gj96-3w95. This link is maintained to preserve external references. Original Description Due to improper parameter filtering in the sequalize js library, can a attacker peform injection...
GHSA-8MWQ-MJ73-QV68 Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements
Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-f598-mfpv-gmfx. This link is maintained to preserve external references. Original Description Due to improper attribute filtering in the sequelize js library, an attacker can peform SQL injections. This issue ca...
@galenjs/framework-next (>=1.0.0 <=1.7.0), @galenjs/models (>=1.1.11 <=1.7.0) +4 more potentially affected by CVE-2023-22580 via @sequelize/core (=7.0.0-alpha.10)
@sequelize/core NPM version =7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22580 Source...
12g (=0.0.27), 1st-project (=1.0.2) +2906 more potentially affected by CVE-2023-22580 via sequelize (>=1.0.2 <=6.28.0)
sequelize NPM version =1.0.2, =0.0.1, =0.0.2, =0.0.1, =1.2.3, =1.0.0, =0.5.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =2.0.1 - @aapokiiso/hsl-congestion-route-pattern-repository =1.0.0 and more Source cves: CVE-2023-22580 Source advisory: OSV:GHSA-8C25-F3MJ-V6H8...
GHSA-8C25-F3MJ-V6H8 Sequelize information disclosure vulnerability
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure...
Sequelize information disclosure vulnerability
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure...
Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements
Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-f598-mfpv-gmfx. This link is maintained to preserve external references. Original Description Due to improper attribute filtering in the sequelize js library, an attacker can peform SQL injections. This issue ca...
CVE-2023-22579
Due to improper parameter filtering in the sequalize js library, can a attacker peform injection...
CVE-2023-22578
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections...
Sql injection
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections...
Input validation
Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure...
CVE-2023-22579
CVE-2023-22579 concerns Sequelize (Node.js ORM). The related docs point to a type-confusion/unsafe fall-through in getWhereConditions that can bypass parameter filtering, enabling an attacker to execute arbitrary code under certain conditions. Affected component: Sequelize runtime; core issue is ...