CVE-2021-3795

semver-regex is vulnerable to Inefficient Regular Expression Complexity...

08cms (1.0.0), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +6872 more potentially affected by CVE-2021-3795 via semver-regex (>=0.1.1, <=3.1.2)

semver-regex NPM version =0.1.1, =0.0.1, =1.0.0, =3.1.4, =1.0.3, =1.0.0, =3.1.6, =0.0.1, =1.0.0, =1.0.0, =1.1.2 - 3vot-clay 2.0.1 - 433bf 0.0.1 and more Source cves: CVE-2021-3795 Source advisory: MEND:CVE-2021-3795...

CVE-2021-3794

vuelidate is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3794

CVE-2021-3794 affects the vuelidate/vuelidate package family. A Regular Expression Denial of Service (ReDoS) vulnerability exists in the url(input) validation path, where crafted input can cause excessive CPU usage, leading to potential availability impact. This is documented across multiple sour...

CVE-2021-3795: Inefficient Regular Expression Complexity

semver-regex is vulnerable to Inefficient Regular Expression Complexity...

serenity:FuzzMarkdown: Crash in void AK::BumpAllocator<true, 2097152ul>::for_each_chunk<AK::UniformBumpAllocator

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5003436362432512 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzMarkdown Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7fc99d2f9028...

Inefficient Regular Expression Complexity in clean-css/clean-css

✍️ Description It allows cause a denial of service when calling function isDataUriResource. 🕵️‍♂️ Proof of Concept // PoC.js var isDataUriResource = require"clean-css/lib/utils/is-data-uri-resource" forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = 'data:' +...

WWWGrep - OWASP Foundation Web Respository

WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was...

Inefficient Regular Expression Complexity in sindresorhus/semver-regex

✍️ Description It allows cause a denial of service when formatting crafted invalid semver versions. 🕵️‍♂️ Proof of Concept // PoC.mjs import semverRegex from 'semver-regex'; forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = '0.0.0-0' + '.-------'.repeati1 + '@';...

Regular Expression Denial Of Service(ReDoS)

flaskrestx is vulnerable to regular expression denial of service. The use of emailregex allows an attacker to send malicious string to cause excessive processing of regex engine...

Improper Access Control in agentejo/cockpit

✍️ Description A local file inclusion vulnerability allows attackers to bypass the need for API Keys when querying private custom API endpoints 🕵️‍♂️ Proof of Concept 1. On the server create a custom API endpoint in /var/www/html/config/api/custom.php as follows: param'test'; if !$test return...

Regular Expression Denial of Service in flask-restx

Flask RESTX contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service in emailregex...

PT-2021-19969

Name of the Vulnerable Software and Affected Versions Flask-RESTX versions prior to 0.5.1 Description The issue is related to a Regular Expression Denial of Service ReDoS vulnerability in the email regex of Flask-RESTX. This vulnerability can be exploited, potentially leading to a denial of...

Regular Expression Denial Of Service (ReDoS)

pillow is vulnerable to regular expression denial of service. The getrgb function accepts user-provided very long color specifier, exhausting regex engine due to excessive CPU consumption and resulting in a Denial of Service...

DEBIAN-CVE-2021-23437

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function...

GHSA-CPH5-M8F7-6C5X axios Inefficient Regular Expression Complexity vulnerability

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity...

nodejs-glob-parent: Regular expression denial of service

A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

python-jinja2: ReDoS vulnerability in the urlize filter

A flaw was found in python-jinja2. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory...