Search for packages
| purl | pkg:npm/sequelize@2.0.3 |
| Next non-vulnerable version | 6.37.8 |
| Latest non-vulnerable version | 7.0.0-next.1 |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1vrt-1c8d-a7f8
Aliases: CVE-2023-22579 GHSA-vqfx-gj96-3w95 |
Due to improper parameter filtering in the sequalize js library, can a attacker peform injection. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-29kb-jnkp-d3aa
Aliases: GMS-2016-81 |
Potential SQL Injection Sequelize contains a potential SQL injection. |
Affected by 13 other vulnerabilities. |
|
VCID-46gy-pvx2-juds
Aliases: GMS-2016-76 |
SQL Injection via LIMIT and ORDER If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. |
Affected by 11 other vulnerabilities. |
|
VCID-52ex-weu3-4kfa
Aliases: CVE-2016-10556 GHSA-9c2p-jw8p-f84v |
SQL Injection in sequelize |
Affected by 9 other vulnerabilities. |
|
VCID-9w1y-5mj4-k7ak
Aliases: GMS-2016-41 |
SQL Injection via GeoJSON SequelizeJS is vulnerable to SQL injection via GeoJSON documents containing a value with a single quote. This vulnerability affects postresql/postgis as well as MySQL. |
Affected by 8 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-ezu8-tyrr-97h8
Aliases: CVE-2023-22580 GHSA-8c25-f3mj-v6h8 |
Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-f2fe-3pwh-gqfm
Aliases: CVE-2016-10550 GHSA-98pq-pmw9-4gpm |
SQL Injection in sequelize |
Affected by 11 other vulnerabilities. |
|
VCID-fb24-gte1-eye2
Aliases: CVE-2019-10749 GHSA-2598-2f59-rmhq |
SQL Injection in sequelize |
Affected by 4 other vulnerabilities. |
|
VCID-hfs8-z16t-a3bk
Aliases: GMS-2016-78 |
Improper Escaping of Bound Arrays In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. |
Affected by 9 other vulnerabilities. |
|
VCID-knsq-g276-cud8
Aliases: GHSA-fw4p-36j9-rrj3 GMS-2020-771 |
Denial of Service in sequelize |
Affected by 3 other vulnerabilities. |
|
VCID-pvvd-pgxk-6fb8
Aliases: CVE-2023-25813 GHSA-wrh9-cjv3-2hpw |
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query. |
Affected by 3 other vulnerabilities. |
|
VCID-q3k8-z561-5fgp
Aliases: CVE-2016-1000225 GHSA-5v9h-q3gj-c32x GMS-2020-770 |
SQL Injection via GeoJSON in sequelize |
Affected by 7 other vulnerabilities. |
|
VCID-qn7w-5asy-tqdh
Aliases: GHSA-wfp9-vr4j-f49j GMS-2019-139 |
NoSQL Injection in sequelize |
Affected by 6 other vulnerabilities. |
|
VCID-y48d-db6q-dqa5
Aliases: CVE-2016-10553 GHSA-2v7q-2xqx-f4q5 |
Potential SQL Injection in sequelize |
Affected by 13 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||