Feather-Sequelize cleanQuery method vulnerable to Prototype Pollution

Feather-Sequelize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution RCE with privileges of application...

GHSA-QPV8-4PJQ-QQH7 feathers-sequelize contains improper input validation leading to SQL injection

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

Sql injection

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

CVE-2022-2422

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

PT-2022-19855 · Unknown · Feathers-Sequelize

Name of the Vulnerable Software and Affected Versions: feathers-sequelize affected versions not specified Description: The issue is related to improper parameter filtering in the Feathers js library, which may lead to SQL injection. This could potentially allow attackers to inject malicious SQL...

CVE-2022-2422

CVE-2022-2422 describes a SQL injection in Feathers.js when using feathers-sequelize, caused by improper input validation in the library. Reports from multiple sources (NVD, Veracode, GHSA, OSV, CVE list) indicate a high/critical impact with potential remote exploitation via standard network vect...

CVE-2022-2422 Feathers - SQL injection via attribute aliases

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

PT-2022-16542 · Unknown · Feathers-Sequelize +1

Name of the Vulnerable Software and Affected Versions: Feathers js library affected versions not specified Description: The issue is related to improper input validation in the Feathers js library, which can lead to a SQL injection attack on the back-end database when the feathers-sequelize packa...

CVE-2022-2422: Improper Neutralization of Special Elements used in an SQL Command

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

PT-2022-19856 · Unknown · Feathers-Sequelize

Name of the Vulnerable Software and Affected Versions: Feather-Sequelize affected versions not specified Description: The cleanQuery method in Feather-Sequelize uses insecure recursive logic to filter unsupported keys from the query object, resulting in a Remote Code Execution RCE with privileges...

CVE-2022-2422 Feathers - SQL injection via attribute aliases

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...

The vulnerability of the sequelize.json() ORM library for applications like Sequelize allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the sequelize.json ORM library for applications like Sequelize is related to the lack of protection for SQL query structures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected informati...

Risks involved with operatorAliases in Sequelize

The risks involved with the operatorAliases option in Sequelize, the popular library for DBMSs The post Risks involved with operatorAliases in Sequelize appeared first on Wallarm Blog...

GHSA-FW4P-36J9-RRJ3 Denial of Service in sequelize

Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service DoS. The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces...

@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +109 more potentially affected by unknown CVE via sequelize (>=4.0.0, <=4.44.3)

sequelize NPM version =4.0.0, =0.0.1, =4.0.2, =1.0.16, =1.0.20, =1.0.18, =1.0.10, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =1.0.6-2ef3451f-b17, =5.1.3, =1.6.7, =0.6.3, =0.6.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-FW4P-36J9-RRJ3...

Denial of Service in sequelize

Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service DoS. The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces...

SQL Injection via GeoJSON in sequelize

Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using STGeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText...

GHSA-5V9H-Q3GJ-C32X SQL Injection via GeoJSON in sequelize

Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using STGeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText...

@loke/mysql-orm (1.12.0), @starboard/models (>=3.0.0, <=3.0.1) +51 more potentially affected by CVE-2016-1000225 via sequelize (>=3.4.1, <=3.23.4)

sequelize NPM version =3.4.1, =3.0.0, =2.0.2, =0.0.1, =0.0.1, =2.0.0-alpha.1, =1.0.2, =0.1.0, =2.8.0, =0.0.1, =10.0.2, =1.0.1, =0.5.2, =0.0.1, =1.2.7 and more Source cves: CVE-2016-1000225 Source advisory: OSV:GHSA-5V9H-Q3GJ-C32X...

@aaa-backend-stack/graphql (>=1.16.1, <=2.4.4), @aaa-backend-stack/graphql-rest-bindings (>=1.16.0, <=1.16.9) +114 more potentially affected by CVE-2019-10749 via sequelize (>=3.0.1, <=3.34.0)

sequelize NPM version =3.0.1, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.12.0, =1.0.22, =2.0.10, =1.0.97, =1.6.489, =1.6.735 and more Source cves: CVE-2019-10749 Source advisory: OSV:GHSA-2598-2F59-RMHQ...