@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +108 more potentially affected by CVE-2019-10752 via sequelize (>=4.0.0, <=4.44.2)

sequelize NPM version =4.0.0, =0.0.1, =4.0.2, =1.0.16, =1.0.20, =1.0.18, =1.0.10, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =1.0.6-2ef3451f-b17, =5.1.3, =1.6.7, =0.6.3, =0.6.5 and more Source cves: CVE-2019-10752 Source advisory: OSV:GHSA-M9JW-237R-GVFV...

GHSA-M9JW-237R-GVFV SQL Injection in sequelize

Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example: js return...

SQL Injection in sequelize

Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example: js return...

SQL Injection

sequelize is vulnerable to SQL injection. The vulnerability exists due to improper escaping of values in the sequelize.json helper function when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite...

CVE-2019-10752

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite...

CVE-2019-10752

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite...

Sql injection

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite...

CVE-2019-10752

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite...

CVE-2019-10752

CVE-2019-10752 affects the Sequelize ORM. All versions prior to 4.44.3 and 5.15.1 are vulnerable to SQL Injection because the helper function sequelize.json() does not escape values properly when formatting sub paths for JSON queries in MySQL, MariaDB and SQLite. The vulnerability is documented a...

CVE-2019-10752: Improper Neutralization of Special Elements used in an SQL Command

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite...

SQL Injection

Overview Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example: retu...

Denial of Service

Overview Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service DoS. The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input tha...

@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +108 more potentially affected by CVE-2019-10752 via sequelize (>=4.0.0, <=4.44.2)

sequelize NPM version =4.0.0, =0.0.1, =4.0.2, =1.0.16, =1.0.20, =1.0.18, =1.0.10, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =1.0.6-2ef3451f-b17, =5.1.3, =1.6.7, =0.6.3, =0.6.5 and more Source cves: CVE-2019-10752 Source advisory: SNYK:JS-SEQUELIZE-459751...

@essential-projects/sequelize_connection_manager (>=3.0.0-7a12b2e-b1, <=3.0.0-df349f85-b6), @kenetto/user-service (>=1.0.0, <=1.1.1) +40 more potentially affected by CVE-2019-10752 via sequelize (>=5.0.0-beta.11, <=5.14.0)

sequelize NPM version =5.0.0-beta.11, =3.0.0-7a12b2e-b1, =1.0.0, =3.5.3, =4.0.0-beta.2, =1.3.5, =0.2.5, =10.0.0-004477d6-b2, =6.0.0-54bba797-b2, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =1.1.5, =1.1.8-nopool and more Source cves: CVE-2019-10752 Source advisory: SNYK:JS-SEQUELIZE-459751...

SQL Injection

Overview sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection due to sequelize.json helper function not escaping values properly when formatting sub paths for JSON queries for MySQ...

Sequelize SQL Injection Vulnerability (CNVD-2019-19314)

Sequelize is a database ORM Object Relational Mapping tool for Node.js. A SQL injection vulnerability exists in Sequelize versions prior to 5.8.11. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit the...

SQL Injection

Overview Affected versions of sequelize are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation If you are using sequelize 5.x, upgrade to...

SQL Injection

sequelize is vulnerable to sql injection attacks. The attacks are possible because the library does not properly escape the JSON path key provided by user using mariadb dialects in query-generator.js...

SQL Injection

sequelize is vulnerable to sql injection attacks. The attacks are possible because the library does not escape the JSON path key provided by the user using postgres dialects in query-generator.js...

SQL Injection

Overview sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection due to JSON path keys not being properly sanitized in the Postgres dialect. PoC by Snyk const Sequelize =...