Thunderbird Credential Gatherer

This module searches for Thunderbird credentials on a Windows host. Module Options msf use post/windows/gather/credentials/thunderbird msf postthunderbird show actions ...actions... msf postthunderbird set ACTION msf postthunderbird show options ...show and set options... msf postthunderbird run...

Operamail Credential Gatherer

This module searches for Operamail credentials on a Windows host. Module Options msf use post/windows/gather/credentials/operamail msf postoperamail show actions ...actions... msf postoperamail set ACTION msf postoperamail show options ...show and set options... msf postoperamail run This module...

Srware Credential Gatherer

This module searches for Srware credentials on a Windows host. SRWare Iron is a Chromium-based web browser developed by the German company SRWare. Module Options msf use post/windows/gather/credentials/srware msf postsrware show actions ...actions... msf postsrware set ACTION msf postsrware show...

Aim Credential Gatherer

This module searches for Aim credentials on a Windows host. Module Options msf use post/windows/gather/credentials/aim msf postaim show actions ...actions... msf postaim set ACTION msf postaim show options ...show and set options... msf postaim run This module requires Metasploit:...

Miranda Credential Gatherer

This module searches for Miranda credentials on a Windows host. Module Options msf use post/windows/gather/credentials/miranda msf postmiranda show actions ...actions... msf postmiranda set ACTION msf postmiranda show options ...show and set options... msf postmiranda run This module requires...

Cross site scripting

The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trpsanitizestring' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored...

CVE-2021-3820

inflect is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3820

inflect is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3828

nltk is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3828

CVE-2021-3828 affects the Python nltk package with a vulnerability to ReDoS (inefficient regular-expression handling). Connected sources show fixes in newer nltk releases (e.g., updates to 3.6.x/3.7, and OpenSUSE/SUSE advisories mentioning python-nltk fixes) and advisories noting the issue in Ubu...

CVE-2021-3822 Inefficient Regular Expression Complexity in josdejong/jsoneditor

jsoneditor is vulnerable to Inefficient Regular Expression Complexity...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

EulerOS 2.0 SP9 : python-jinja2 (EulerOS-SA-2021-2538)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator an...

Josdejong Jsoneditor resource management error vulnerability

Josdejong Jsoneditor is a web page based software for viewing, editing, and validating Json data by the individual developer Josdejong. A resource management error vulnerability exists in Jsoneditor that stems from an error in a regular expression in the product. An attacker could use this...

EulerOS 2.0 SP5 : python-jinja2 (EulerOS-SA-2021-2516)

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator an...

CVE-2021-3807

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

EulerOS 2.0 SP8 : python-jinja2 (EulerOS-SA-2021-2482)

According to the versions of the python-jinja2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator a...

Ubuntu 21.04 : SQL parse vulnerability (USN-5085-1)

The remote Ubuntu 21.04 host has packages installed that are affected by a vulnerability as referenced in the USN-5085-1 advisory. It was discovered that SQL parse incorrectly handled certain regular expression. An attacker could possibly use this issue to cause a denial of service. Tenable has...

Inefficient Regular Expression Complexity in tapjs/tap-mocha-reporter

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in tap-mocha-reporter. The ReDoS vulnerability is mainly due to the regex /^\s+|\s+$|/g and can be exploited with the following code. Proof of Concept // PoC.js var tapMochaReporter =...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...