Victor Pasman (DIVD)

Sequalize - Unsafe fall-through in getWhereConditions

Cloudflow - Unauthenticated file upload vulnerability

Visioweb.js - Prototype Pollution can results in XSS

Feathers - SQL injection via attribute aliases

Socket.io - Improper type validation in attachment parsing

ITarian - Session cookie not protected by HttpOnly flag

ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection

Feathers - Query “__proto__” is converted to real prototype

Cloudflow - Local File Inclusion Vulnerability