PYSEC-2022-5

nltk is vulnerable to Inefficient Regular Expression Complexity...

PYSEC-2022-5

nltk is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-40110

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of...

nltk 安全漏洞

Nltk is a natural language toolkit. It is used to support research and development in natural language processing. A security vulnerability exists in nltk that stems from an exception being triggered during the processing of regular expressions...

PT-2022-1455 · Pypi +9 · Pillow +9

Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 9.0.1 Description: The issue allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used, potentially enabling a remote attacker to execute arbitrar...

CbioPortal Denial of Service Vulnerability

CbioPortal is used to provide visualization, analysis, and download of large-scale cancer genomics datasets. a denial-of-service vulnerability exists in CbioPortal in versions 3.6.21 and earlier, which stems from the insecure handling of regular expressions in /ProteinArraySignificanceTest.json,...

jfinal denial of service vulnerability

JFinal is a Java language based WEB ORM open source framework. jFinal cms in versions prior to 5.1.0 there is a denial of service vulnerability , the vulnerability stems from the application of regular expressions on the insecure handling of user input , the attacker can use the vulnerability...

jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...

Unspecified vulnerability in calibre

Calibre is an open source free all-in-one eBook reading management and format conversion tool. A security vulnerability exists in calibre before 5.32.0, which stems from the inclusion of regular expressions vulnerable to ReDoS Regular Expression Denial of Service attacks in htmlpreprocessrules in...

Calibre 资源管理错误漏洞

Calibre is an open source free all-in-one eBook reading management and format conversion tool. A security vulnerability exists in calibre before 5.32.0, which stems from the inclusion of regular expressions vulnerable to ReDoS Regular Expression Denial of Service attacks in htmlpreprocessrules in...

openSUSE 15 Security Update : python-Pygments (openSUSE-SU-2021:1521-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1521-1 advisory. - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular...

openSUSE 15 Security Update : python-Pygments (openSUSE-SU-2021:3839-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:3839-1 advisory. - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular...

SUSE SLES12 Security Update : python-Pygments (SUSE-SU-2021:3814-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:3814-1 advisory. - CVE-2021-27291: Fixed ReDoS via crafted malicious input bsc1184812. Tenable has extracted the preceding description block directly from the SUSE...

Remote Code Execution (RCE)

spring-cloud-netflix-hystrix-dashboard is vulnerable to remote code execution. Lack of secure validation of request URI path allows an attacker to send a malicious request at /hystrix/monitor;user-provided data,causing execution of malicious code because path elements following hystrix/monitor ar...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

Code injection in spring-cloud-netflix-hystrix-dashboard

Applications using the spring-cloud-netflix-hystrix-dashboard expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following hystrix/monitor are being evaluated ...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

Oracle Linux 8 : resource-agents (ELSA-2021-9553)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9553 advisory. - python-pygments: fix CVE-2021-27291 and CVE-2021-20270 Resolves: rhbz1872754, rhbz1934651, rhbz1935422, rhbz1943464 Tenable has extracted the precedi...

Cron Utils Code Injection Vulnerability

Cron Utils is Jmrozanec individual developers of a Java code base for validating , parsing , migrating Cron expressions . A code injection vulnerability exists in Cron Utils that allows an attacker to inject arbitrary Java EL expressions to execute remote code...