rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-10666 
An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T12:58:13.000Z
CVE-2019-10667 
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T12:59:17.000Z
CVE-2019-10668 
An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T13:00:17.000Z
CVE-2019-10669 
An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. This function is not the appropriate function to sanitize command arguments as it does not escape a number of command line syntax characters such as ` (backtick), allowing an attacker to inject commands into the variable $rrd_cmd, which gets executed via passthru().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T12:46:12.000Z
CVE-2019-10670 
An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these contexts, leading to attacker controlled JavaScript executing in the browser. One example of this is the string parameter in html/pages/inventory.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T13:07:26.000Z
CVE-2019-10671 
An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T13:01:21.000Z
CVE-2019-10672 
treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-31T16:48:18.000Z
CVE-2019-10673 
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-03T04:12:07.000Z
CVE-2019-10676 
An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within the browser until a decision is made. The code of the pop-up window can be read by remote servers and contains the login credentials and URL in cleartext. A malicious server could easily grab this information from the pop-up. This is related to id="uniqkey-password-popup" and password-popup/popup.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T16:32:16.000Z
CVE-2019-10677 
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-05T13:23:06.000Z
CVE-2019-10678 
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-31T20:53:54.000Z
CVE-2019-10679 
Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-03T14:40:25.000Z
CVE-2019-10682 
django-nopassword before 5.0.0 stores cleartext secrets in the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T15:01:13.000Z
CVE-2019-10684 
Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T15:37:21.000Z
CVE-2019-10685 
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Heidelberg Prinect Archiver v2013 release 1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:17:53.000Z
CVE-2019-10686 
An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T16:21:00.000Z
CVE-2019-10687 
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T19:19:18.000Z
CVE-2019-10688 
VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T20:58:29.000Z
CVE-2019-10689 
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T21:10:20.000Z
CVE-2019-10691 
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-24T16:49:37.000Z
CVE-2019-10692 
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-02T17:37:16.000Z
CVE-2019-10694 
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.
Problem types: description: Credentials Management
Affected products: vendor: n/a
product: Puppet Enterprise
Published: 2019-12-11T23:02:26.000Z
CVE-2019-10695 
When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the job’s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module.
Problem types: description: Insufficiently Protected Credentials
Affected products: vendor: n/a
product: Continuous Delivery for Puppet Enterprise (CD4PE)
Published: 2019-12-11T23:04:57.000Z
CVE-2019-10705 
Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted without knowledge of proper authentication credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T14:47:22.000Z
CVE-2019-10706 
Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T12:45:10.000Z
CVE-2019-10707 
MKCMS V5.0 has SQL injection via the bplay.php play parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-02T18:51:16.000Z
CVE-2019-10708 
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-02T18:51:31.000Z
CVE-2019-10709 
AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially privilege escalation via a crafted DeviceIoControl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-04T11:14:39.000Z
CVE-2019-10710 
Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T19:06:47.000Z
CVE-2019-10711 
Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.1) allows attackers to view an RTSP stream by connecting to the stream with hidden credentials (guest or user) that are neither displayed nor configurable in the camera's CamHi or keye mobile management application. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T19:21:41.000Z
CVE-2019-10712 
The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872, 750-873) devices has undocumented service access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T21:20:03.000Z
CVE-2019-10714 
LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-02T20:16:04.000Z
CVE-2019-10715 
There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-20T23:44:35.000Z
CVE-2019-10716 
An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-20T23:47:26.000Z
CVE-2019-10717 
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T15:40:20.000Z
CVE-2019-10718 
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T18:23:15.000Z
CVE-2019-10719 
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T18:11:57.000Z
CVE-2019-10720 
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T18:13:16.000Z
CVE-2019-10721 
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T15:23:03.000Z
CVE-2019-10723 
An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-03T17:01:04.000Z
CVE-2019-10724 
There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520T_Z370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642, AIO510-23ISH 6.0.1.8642, AIO520-22IKL 6.0.1.8642, AIO520-22IKU 6.0.1.8642, AIO520-24IKL 6.0.1.8642, AIO520-24IKU 6.0.1.8642, AIO520-27IKL 6.0.1.8642, AIO720-24IKB 6.0.1.8642, IdeaCentre 520S-23IKU 6.0.1.8642, ThinkCentre M700z 6.0.1.8642, ThinkCentre M800z 6.0.1.8642, ThinkCentre M810z 6.0.1.8642, ThinkCentre M818z 6.0.1.8642, ThinkCentre M900Z 6.0.1.8642, ThinkCentre M910z 6.0.1.8642, V410z(YT S4250) 6.0.1.8642, 330-14IKBR Win10:6.0.1.8652, 330-15IKBR Win10:6.0.1.8652, 330-15IKBR (Brazil) Win10:6.0.1.8652, 330-15IKBR Touch Win10:6.0.1.8652, 330-17IKBR Win10:6.0.1.8652, YOGA 730-13IKB Win10:6.0.1.8644, YOGA 730-15IKB Win10:6.0.1.8644, ThinkPad L560 6.0.1.8644 and 6.0.1.8652, ThinkPad L570 6.0.1.8644 and 6.0.1.8652, ThinkPad P50 6.0.1.8642, ThinkPad P50s 6.0.1.8642, ThinkPad P51s (20Jx, 20Kx) 6.0.1.8642, ThinkPad P51s (20Hx) 6.0.1.8642, ThinkPad P52s 6.0.1.8642, ThinkPad P70 6.0.1.8642, ThinkPad T25 6.0.1.8642, ThinkPad T460s 6.0.1.8642, ThinkPad T470 6.0.1.8642, ThinkPad T470s 6.0.1.8642, ThinkPad T480 6.0.1.8642, ThinkPad T480s 6.0.1.8642, ThinkPad T560 6.0.1.8642, ThinkPad T570 6.0.1.8642, ThinkPad T580 6.0.1.8642, ThinkPad X1 Carbon 8.66.76.72 and 8.66.68.54, ThinkPad X1 Carbon 6th 6.0.1.8642, ThinkPad X1 Carbon, X1 Yoga 8.66.62.92 and 8.66.62.54, ThinkPad X1 Tablet (20Gx) 6.0.1.8642, ThinkPad X1 Tablet (20Jx) 6.0.1.8642, ThinkPad X1 Tablet Gen 3 6.0.1.8642, ThinkPad X1 Yoga (20Jx) 8.66.88.60, ThinkPad X1 Yoga 3rd 6.0.1.8642, ThinkPad X280 6.0.1.8642, ThinkPad Yoga 260, S1 8.66.62.92 and 8.66.62.54.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T23:01:17.000Z
CVE-2019-10732 
In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-07T14:32:10.000Z
CVE-2019-10734 
In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-07T14:34:33.000Z
CVE-2019-10735 
In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-07T14:35:32.000Z
CVE-2019-10740 
In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-07T14:36:23.000Z
CVE-2019-10741 
K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an attacker to obtain valid S/MIME or PGP signatures for arbitrary content to be displayed to a third party. NOTE: the vendor states "We don't plan to take any action because of this."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-07T14:37:51.000Z
CVE-2019-10742 
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
Problem types: description: n/a
Affected products: vendor: axios
product: axios
Published: 2019-05-07T18:40:06.000Z
CVE-2019-10743 
All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: archiver
Published: 2019-10-28T22:09:22.000Z
CVE-2019-10744 
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Problem types: description: Prototype Pollution
Affected products: vendor: Snyk
product: lodash
Published: 2019-07-25T23:43:03.000Z
CVE-2019-10745 
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: assign-deep
Published: 2019-08-20T18:13:22.000Z
CVE-2019-10746 
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: mixin-deep
Published: 2019-08-23T16:43:49.000Z
CVE-2019-10747 
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: set-value
Published: 2019-08-23T16:46:36.000Z
CVE-2019-10748 
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: Sequelize
Published: 2019-10-28T21:42:45.000Z
CVE-2019-10749 
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: sequelize
Published: 2019-10-29T16:06:05.000Z
CVE-2019-10750 
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: deeply
Published: 2019-08-23T16:50:36.000Z
CVE-2019-10751 
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Problem types: description: Open Redirect
Affected products: vendor: n/a
product: HTTPIE
Published: 2019-08-23T16:38:35.000Z
CVE-2019-10752 
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: sequelize
Published: 2019-10-17T18:12:43.000Z