python-jinja2: ReDoS vulnerability in the urlize filter

A flaw was found in python-jinja2. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory...

Jsleak - A Go Code To Detect Leaks In JS Files Via Regex Patterns

jsleak is a tool to identify sensitive data in JS files through regex patterns. Although it's built for this, you can use it to identify anything as long as you have a regex pattern for it. How to install Directly: your package manager install pkg-config libpcre++-dev go get...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

Code injection

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580

Apache Roller suffers a vulnerability where user-controlled inputs from Referer, Request URL, and QueryString are used to build and execute a regex, enabling regular-expression DoS (ReDoS) via catastrophic backtracking on the server. Impact described as availability issues; fixed in Roller 6.0.2....

CVE-2021-33580 regex injection leading to DoS

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

[SECURITY] Fedora 34 Update: rust-fancy-regex-0.7.0-1.fc34

Implementation of regexes, supporting a relatively rich set of features, including backreferences and look-around...

[SECURITY] Fedora 34 Update: rust-sd-0.7.6-4.fc34

Intuitive find & replace CLI. Painless regular expressions sd uses regex syntax that you already know from JavaScript and Python. Forget about dealing with quirks of sed or awk - get productive immediately. String-literal mode Non-regex find & replace. No more backslashes or remembering which...

Fedora: Security Advisory for rust-fancy-regex (FEDORA-2021-3cf88e44b4)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

GHSA-HJ48-42VR-X3V9 Regular Expression Denial of Service in path-parse

Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

960.css (1.0.0), @4site/engrid-styles (>=0.2.19, <=0.2.24) +120 more potentially affected by CVE-2021-23343 via path-parse (>=1.0.5, <=1.0.6)

path-parse NPM version =1.0.5, =0.2.19, =0.1.1, =7.0.0-2, =0.2.0, =0.17.0, =0.17.0, =0.19.0, =0.17.0, =0.23.0, =0.17.0, =0.17.0, =0.17.1 - @choerodon/issue 0.17.0 and more Source cves: CVE-2021-23343 Source advisory: OSV:GHSA-HJ48-42VR-X3V9...

boost:boost_regex_fuzzer: Segv on unknown address in boost::re_detail_500::basic_regex_creator<char, boost::regex_traits<char, boost:

Project: https://github.com/boostorg/boost.git Detailed Report: https://oss-fuzz.com/testcase?key=6105427325616128 Project: boost Fuzzing Engine: libFuzzer Fuzz Target: boostregexfuzzer Job Type: libfuzzerasanboost Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

Regular Expression Denial of Service in System.Text.RegularExpressions

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981...

GHSA-CMHX-CQ75-C4MJ Regular Expression Denial of Service in System.Text.RegularExpressions

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981...

Pi-Hole Top Domains API Authenticated Exec

This exploits a command execution in Pi-Hole Web Interface API/Web inetrace page contains the field Top Domains/Top Advertisers which is validated by a regex which does not properly filter system commands, which can then be executed by calling the gravity functionality. However, the regex only...

OESA-2021-1296 glibc security update

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...