Regular Expression Denial Of Service (ReDoS)

ansi-html is vulnerable to regular expression denial of service. An attacker is able to exploit the vulnerability by injecting a malicious long string of digits into the system...

CVE-2021-23425

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing...

CVE-2021-23425

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing...

CVE-2021-23424 Regular Expression Denial of Service (ReDoS)

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time...

CVE-2021-23425

CVE-2021-23425 affects the nodejs-trim-off-newlines package; all versions of trim-off-newlines are vulnerable to ReDoS via string processing. The issue is confirmed in multiple sources (NVD entry and Red Hat advisory RHSA-2022:4711) with an overall Medium impact (CVSS v3.1 base score 5.3; Availab...

CVE-2021-23425 Regular Expression Denial of Service (ReDoS)

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing...

CVE-2021-23425

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing...

cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...

cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the @Cron annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

stevemao trim-off-newlines 处理逻辑错误漏洞

trim-off-newlines is used by NPM to remove line breaks. A processing logic error vulnerability exists in stevemao trim-off-newlines that stems from the fact that all versions of trim-off-newlines are susceptible to a Regular Expression Denial of Service ReDoS attack via string processing...

CVE-2021-33199

In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-get'file' instead of the fixed file names of icon.png and icon.svg...

CVE-2021-33199

In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-get'file' instead of the fixed file names of icon.png and icon.svg...

CVE-2021-33199

In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-get'file' instead of the fixed file names of icon.png and icon.svg...

Input validation

In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-get'file' instead of the fixed file names of icon.png and icon.svg...

CVE-2021-33199

CVE-2021-33199 affects Expression Engine prior to 6.0.3. The vulnerability resides in addonIcon in Addons/file/mod.file.php, which uses the untrusted input value input->get('file') instead of the fixed file names icon.png and icon.svg. This results in input validation issues with the addonIcon...

CVE-2021-33199

In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-get'file' instead of the fixed file names of icon.png and icon.svg...

Oracle Linux 8 : nodejs:14 (ELSA-2021-3074)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3074 advisory. - Resolves CVE-2021-22918libuv, use system cipher list Tenable has extracted the preceding description block directly from the Oracle Linux security...

CentOS 8 : nodejs:14 (CESA-2021:3074)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3074 advisory. - libuv: out-of-bounds read in uvidnatoascii can lead to information disclosures or crashes CVE-2021-22918 - nodejs-hosted-git-info: Regular Expression...

Oracle Linux 8 : nodejs:12 (ELSA-2021-3073)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3073 advisory. - Resolves CVE-2021-22918libuv, use system cipher list nodejs-nodemon Tenable has extracted the preceding description block directly from the Oracle...