494 matches found
@aaa-backend-stack/graphql (>=1.16.1, <=2.4.4), @aaa-backend-stack/graphql-rest-bindings (>=1.16.0, <=1.16.9) +114 more potentially affected by CVE-2019-10749 via sequelize (>=3.0.1, <=3.34.0)
sequelize NPM version =3.0.1, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.12.0, =1.0.22, =2.0.10, =1.0.97, =1.6.489, =1.6.735 and more Source cves: CVE-2019-10749 Source advisory: SNYK:JS-SEQUELIZE-450222...
SQL Injection
Overview sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects. PoC by Snyk const Sequelize =...
@aaa-backend-stack/graphql (>=1.16.1, <=2.4.4), @aaa-backend-stack/graphql-rest-bindings (>=1.16.0, <=1.16.9) +114 more potentially affected by CVE-2019-10748 via sequelize (>=3.0.1, <=3.34.0)
sequelize NPM version =3.0.1, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.12.0, =1.0.22, =2.0.10, =1.0.97, =1.6.489, =1.6.735 and more Source cves: CVE-2019-10748 Source advisory: SNYK:JS-SEQUELIZE-450221...
@essential-projects/sequelize_connection_manager (>=3.0.0-7a12b2e-b1, <=3.0.0-df349f85-b6), @nelreina/node-sequelize (>=3.5.3, <=3.5.5) +26 more potentially affected by CVE-2019-10748 via sequelize (>=5.0.0-beta.11, <=5.8.10)
sequelize NPM version =5.0.0-beta.11, =3.0.0-7a12b2e-b1, =3.5.3, =4.0.0-beta.2, =10.0.0-004477d6-b2, =6.0.0-54bba797-b2, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =1.1.5, =5.4.0, =5.4.0, =5.4.1 and more Source cves: CVE-2019-10748 Source advisory: SNYK:JS-SEQUELIZE-450221...
@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +108 more potentially affected by CVE-2019-10748 via sequelize (>=4.0.0, <=4.44.2)
sequelize NPM version =4.0.0, =0.0.1, =4.0.2, =1.0.16, =1.0.20, =1.0.18, =1.0.10, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =1.0.6-2ef3451f-b17, =5.1.3, =1.6.7, =0.6.3, =0.6.5 and more Source cves: CVE-2019-10748 Source advisory: SNYK:JS-SEQUELIZE-450221...
Sensitive Data Exposure in sequelize-cli
Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...
GHSA-3XC7-XG67-PW99 Sensitive Data Exposure in sequelize-cli
Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...
@wize/sequelize-runtime (>=1.1.1, <=1.2.1), @wize/sequelize-source (>=1.2.5, <=1.2.6) +23 more potentially affected by unknown CVE via sequelize (>=4.0.0, <=4.11.1)
sequelize NPM version =4.0.0, =1.1.1, =1.2.5, =1.1.0, =1.2.0, =1.1.0, =1.1.0, =1.0.0, =0.1.0, =0.5.0, =1.0.0, =0.2.0, =0.4.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WFP9-VR4J-F49J...
NoSQL Injection in sequelize
Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later...
GHSA-WFP9-VR4J-F49J NoSQL Injection in sequelize
Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later...
Sensitive Information Disclosure
sequelize-cli is vulnerable to sensitive information disclosure. The vulnerability exists as the config.password value is logged unencrypted into log files, allowing a local user to retrieve the configuration password...
Sensitive Data Exposure
Overview Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...
SQL Injection
Overview Versions of sequelize prior to 5.3.0 excluding v3 and v4 are vulnerable to SQL Injection. PostgreSQL optionstandardconformingstrings is not set to on by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals. Recommendation...
NoSQL Injection
Overview Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later References - GitHub Issue - Snyk...
@nodefony/sequelize-bundle (>=4.0.0-beta.2, <=4.2.0-beta.2), @sequelizejs/next (5.0.0-beta.16) +5 more potentially affected by CVE-2019-11069 via sequelize (>=5.0.0-beta.11, <=5.2.3)
sequelize NPM version =5.0.0-beta.11, =4.0.0-beta.2, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =1.0.0-beta1, =1.0.0-beta2.2 Source cves: CVE-2019-11069 Source advisory: OSV:GHSA-2777-2VQ8-C4V4...
SQL Injection in sequelize
Versions of sequelize prior to 5.3.0 excluding v3 and v4 are vulnerable to SQL Injection. PostgreSQL optionstandardconformingstrings is not set to on by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals. Recommendation Upgrade to...
GHSA-2777-2VQ8-C4V4 SQL Injection in sequelize
Versions of sequelize prior to 5.3.0 excluding v3 and v4 are vulnerable to SQL Injection. PostgreSQL optionstandardconformingstrings is not set to on by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals. Recommendation Upgrade to...
SQL Injection
sequelize is vulnerable to SQL injection when using with PostgreSQL. This is due to backslashes that are not being escaped properly in non-standard strings, allowing a remote attacker to inject and execute arbitrary SQL statements in the database...
