Patchfirst
Patchfirst
ChainHackerOne · sequelize node modulenpm:sequelize

HackerOne sequelize node module: successive fixes (2016–2019)

5 CVEs over 3 generations, 29 May 2018 to 29 Oct 2019.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2016-1055629 May 2018 next fix after CVE-2016-10550
  2. CVE-2016-1055031 May 2018 next fix after CVE-2016-10553
  3. CVE-2016-1055331 May 2018 No direct link to an earlier CVE
  4. CVE-2019-1074828 Oct 2019 related to CVE-2016-10550next fix after CVE-2016-10556
  5. CVE-2019-1074929 Oct 2019 related to CVE-2016-10550related to CVE-2019-10748and 1 more
May 2018JunDecOct 2019 CVE-2016-10556 → CVE-2016-10550: Next fix in the same package (medium confidence)CVE-2016-10550 → CVE-2019-10748: related (medium confidence)CVE-2016-10550 → CVE-2019-10749: related (medium confidence)CVE-2016-10550 → CVE-2016-10553: Next fix in the same package (medium confidence)CVE-2019-10748 → CVE-2019-10749: related (medium confidence)CVE-2016-10556 → CVE-2019-10748: Next fix in the same package (low confidence)CVE-2016-10556 → CVE-2019-10749: Next fix in the same package (low confidence) CVE-2016-10556 29 May 2018 CVE-2016-10550 31 May 2018 CVE-2016-10553 31 May 2018 CVE-2019-10748 28 Oct 2019 CVE-2019-10749 29 Oct 2019 May 2018JunOctFeb 2019JunOct CVE-2016-10556 → CVE-2016-10550: Next fix in the same package (medium confidence)CVE-2016-10550 → CVE-2019-10748: related (medium confidence)CVE-2016-10550 → CVE-2019-10749: related (medium confidence)CVE-2016-10550 → CVE-2016-10553: Next fix in the same package (medium confidence)CVE-2019-10748 → CVE-2019-10749: related (medium confidence)CVE-2016-10556 → CVE-2019-10748: Next fix in the same package (low confidence)CVE-2016-10556 → CVE-2019-10749: Next fix in the same package (low confidence) CVE-2016-10556 29 May 2018 CVE-2016-10550 31 May 2018 CVE-2016-10553 31 May 2018 CVE-2019-10748 28 Oct 2019 CVE-2019-10749 29 Oct 2019
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2016-10556 29 May 2018 sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and… · fixed in 3.20.0 CVE-2016-10550 · Next fix in the same package · Medium 14.2
CVE-2016-10550 31 May 2018 sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and… · fixed in 3.17.0 CVE-2016-10553 · Next fix in the same package · Medium 15.9
CVE-2016-10553 31 May 2018 sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and… · fixed in 3.0.0 First in chain 13.9
CVE-2019-10748 28 Oct 2019 Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not… · fixed in 5.8.11 CVE-2016-10550 · related · Medium 14.1
CVE-2019-10749 29 Oct 2019 sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being… · fixed in 3.35.1 CVE-2016-10550 · related · Medium 13.8
↑ ↓ chooseEnter openEsc close