{"id":"CVE-2016-10553","published":"2018-05-31T20:00:00Z","modified":"2024-09-17T00:16:46Z","title":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and…","vendor":"HackerOne","product":"sequelize node module","tier":"tail","description":{"text":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01265,"percentile":0.69621,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://nodesecurity.io/advisories/109","tags":["x_refsource_MISC"]},{"url":"https://github.com/sequelize/sequelize/blob/master/changelog.md#300","tags":["x_refsource_MISC"]}],"priority":{"score":13.9,"factors":[{"name":"EPSS percentile","points":13.92}]},"vendorSlug":"hackerone","affectedVersions":[{"vendor":"HackerOne","product":"sequelize node module","versions":["<= 2.1.3"]}],"affected":[{"ecosystem":"npm","package":"sequelize","vulnerableRanges":["<3.0.0"],"patched":["3.0.0"],"from":["GHSA-2v7q-2xqx-f4q5"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0204","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hackerone-sequelize-node-module-cve-2016-10556","packageHistory":[{"cve":"CVE-2016-10554","published":"2018-05-31","fixed":"1.7.0","kev":false},{"cve":"CVE-2015-1369","published":"2015-01-27","fixed":"2.0.0-rc8","kev":false},{"cve":"CVE-2016-10553","published":"2018-05-31","fixed":"3.0.0","kev":false},{"cve":"CVE-2016-10550","published":"2018-05-31","fixed":"3.17.0","kev":false,"link":{"from":"CVE-2016-10553","to":"CVE-2016-10550","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sequelize","fromFixed":"3.0.0","toFixed":"3.17.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.86,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2016-10556","published":"2018-05-29","fixed":"3.20.0","kev":false},{"cve":"CVE-2019-10749","published":"2019-10-29","fixed":"3.35.1","kev":false}],"package":"npm:sequelize"}}