CVE-2019-11069

Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.

• CWE-20

• https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160Third Party Advisory
• https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9
• https://github.com/sequelize/sequelize/pull/10746/filesPatch, Third Party Advisory
• https://github.com/sequelize/sequelize/releases/tag/v5.3.0Release Notes, Third Party Advisory
• https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160Third Party Advisory
• https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9
• https://github.com/sequelize/sequelize/pull/10746/filesPatch, Third Party Advisory
• https://github.com/sequelize/sequelize/releases/tag/v5.3.0Release Notes, Third Party Advisory

Published

Apr 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11062The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS C…9.8
• CVE-2019-11063A broken access control vulnerability in SmartHome app (Andr…10
• CVE-2019-11064A vulnerability of remote credential disclosure was discover…9.8
• CVE-2019-11065Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL t…5.9
• CVE-2019-11066openid.php in LightOpenID through 1.3.1 allows SSRF via a cr…
• CVE-2019-11068libxslt through 1.1.33 allows bypass of a protection mechani…9.8
• CVE-2019-1107A remote code execution vulnerability exists in the way that…
• CVE-2019-11070WebKitGTK and WPE WebKit prior to version 2.24.1 failed to p…
• CVE-2019-11071SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authentic…
• CVE-2019-11072lighttpd before 1.4.54 has a signed integer overflow, which …
• CVE-2019-11073A Remote Code Execution vulnerability exists in PRTG Network…7.2
• CVE-2019-11074A Write to Arbitrary Location in Disk vulnerability exists i…7.2