PT-2024-5350 · Jq +1 · Jq +1

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10.8 Argo CD versions prior to 2.9.13 Argo CD versions prior to 2.8.17 Description: The issue is related to a Denial of Service DoS vulnerability via Out of Memory OOM using jq in ignoreDifferences. This...

Spring Tips: the Spring Expression Language

Hi, Spring fans! In this installment, I look at the excellent Spring Expression Language, an embedded language for resolving simple expressions that is built right into the Spring Framework...

SheetJS 安全漏洞

SheetJS is a software application. A parser and writer for various spreadsheet formats. A security vulnerability exists in SheetJS Community Edition prior to version 0.20.2 that stems from vulnerability to regular expression denial of service attacks...

Denial Of Service (DoS)

katex is vulnerable to a Denial of Service DoS attack. The vulnerability is due to the inadequate handling of untrusted mathematical expressions containing \def or \newcommand, which leads to a near-infinite loop despite efforts to mitigate it with mechanisms like maxExpand...

Denial Of Service (DoS)

katex is vulnerable to a Denial of Service DoS attack. The vulnerability is due to the inadequate handling of untrusted mathematical expressions, which can lead to a near-infinite loop despite setting maxExpand to prevent such occurrences...

python-django: Denial-of-service possibility in django.utils.text.Truncator

An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs...

CVE-2024-28245 KaTeX's \includegraphics does not escape filename

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability...

CVE-2024-28245

CVE-2024-28245 affects KaTeX, a JavaScript library for TeX rendering. The issue arises when rendering untrusted inputs via the \includegraphics pathway, potentially enabling arbitrary JavaScript execution or invalid HTML due to insufficient escaping. The root cause described in the linked advisor...

CVE-2024-28244

KaTeX, a JavaScript library for web TeX rendering, has a vulnerability where Unicode subscript/superscript characters create separate Parser instances that do not inherit the parent macro-execution limit, bypassing maxExpand and allowing near-infinite loops. This affects inputs rendering untruste...

CVE-2024-28243

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \edef that causes a near-infinite loop, despite setting maxExpand to avoid such loops. This can be used as an availability attack, where...

CVE-2024-28243 KaTeX's maxExpand bypassed by \edef

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \edef that causes a near-infinite loop, despite setting maxExpand to avoid such loops. This can be used as an availability attack, where...

PT-2024-22360

Name of the Vulnerable Software and Affected Versions: KaTeX versions prior to 0.16.10 Description: KaTeX is a JavaScript library for TeX math rendering on the web. Users who render untrusted mathematical expressions could encounter malicious input using includegraphics that runs arbitrary...

KaTeX 安全漏洞

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. A security vulnerability existed prior to the KaTeX v0.16.10 release, which stemmed from the fact that KaTeX users rendering untrusted mathematical expressions could encounter malicious input using edef, potentiall...

Debian dla-3768 : python-pil - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3768 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3768-1 [email protected]...

PT-2024-40670 · Pcre2 · Pcre2

Name of the Vulnerable Software and Affected Versions: PCRE2 affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash occurs in the pcre2 fuzzsupport.c file, specifically due to a heap-buffer-overflow read of 4 bytes. Recommendations: At the...

django-wiki Security Vulnerabilities

django-wiki is a wiki system based on Django. A security vulnerability exists in versions of django-wiki prior to 0.10.1, which stems from vulnerability to maliciously crafted article content that could lead to a denial of service via regular expressions...

CVE-2024-28254

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The ‎AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the...

Fedora: Security Advisory for jakarta-oro (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for libformula (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: libformula-1.1.3-43.fc40

LibFormula provides Excel-Style-Expressions. The implementation provided here is very generic and can be used in any application that needs to compute formulas...