801 matches found
PYSEC-2020-155
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
CVE-2020-5236
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
PYSEC-2020-155
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
GHSA-73M2-3PWG-5FGC Catastrophic backtracking in regex allows Denial of Service in Waitress
Impact When waitress receives a header that contains invalid characters it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This would allow an attacker to send a single request with an invalid...
CVE-2020-5236
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
CVE-2016-1000237
sanitize-html before 1.4.3 has XSS...
Cross site scripting
sanitize-html before 1.4.3 has XSS...
CVE-2016-1000237
CVE-2016-1000237 affects sanitize-html prior to 1.4.3, where input is not sanitized recursively which may allow XSS. Documented in multiple sources (Node.js advisory GHSA-3J7M-HMH3-9JMP, Red Hat, Debian, NVD/NVD list). Impact is cross-site scripting via vulnerable sanitize-html versions; exploita...
PT-2020-7942
Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 1.4.3 Description: The issue allows an attacker to execute arbitrary Javascript due to the lack of recursive sanitization of input in affected versions of sanitize-html. Recommendations: Update to version 1.4.3...
WallacePOS Code Issue Vulnerability
WallacePOS is a web-based open source point of sale and retail management system. A code issue vulnerability exists in WallacePOS 1.4.3, which can be exploited by a remote authenticated attacker to execute arbitrary code by uploading a malicious PHP file...
WallacePOS Cross-Site Scripting Vulnerability (CNVD-2019-25985)
WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site scripting vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from the WE...
WallacePOS Cross-Site Request Forgery Vulnerability
WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site request forgery vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from...
CVE-2019-3960
Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute arbitrary code by uploading a malicious PHP file...
CVE-2019-3959
Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link...
CVE-2019-3958
Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...
Cross site request forgery (csrf)
Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link...
Cross site scripting
Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...
CVE-2019-3959
Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link...
CVE-2019-3959
CVE-2019-3959 affects WallacePOS 1.4.3 via Cross-Site Request Forgery. A remote attacker can trigger sensitive actions by convincing a logged-in user to visit a crafted link. Root causes cited include inadequate verification of request origin in the web application. CVSS data in the record indica...
