TI-2022-12183 CVE-2022-29823 · GHSA-p5m3-27vh-52j4
Feathers - Query “__proto__” is converted to real prototype
Priority MEDIUM 47
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object.
feathersjs
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
feathersjs records in CISA KEVNo feathersjs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records in Feathers-sequelize · all components
TI-2022-12182 CVE-2022-29822 · GHSA-5hq7-j5wq-p227
Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection
Priority MEDIUM 45
Due to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection
TI-2022-02237 CVE-2022-2422 · GHSA-qpv8-4pjq-qqh7
Feathers - SQL injection via attribute aliases
Priority MEDIUM 45
Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.