2925 matches found
USN-3834-1: Perl vulnerabilities
Jayakrishna Menon discovered that Perl incorrectly handled Perlmysetenv. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2018-18311 Eiichi Tsukata discovered that Perl incorrectly handled certain regular expression...
USN-3834-1 perl vulnerabilities
Jayakrishna Menon discovered that Perl incorrectly handled Perlmysetenv. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2018-18311 Eiichi Tsukata discovered that Perl incorrectly handled certain regular expression...
Perl Heap Overflow Vulnerability
Perl is a high-level, general-purpose, interpreted, dynamic programming language. A heap overflow vulnerability exists in Sregatom in 'regcomp.c' in Perl 5.28 during compilation, which can be exploited by a remote attacker to execute arbitrary code via specially crafted regular expressions...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-3817-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3817-1 advisory. It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this issue to cause Python t...
Ubuntu: Security Advisory (USN-3817-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-3817-1 python2.7, python3.4, python3.5 vulnerabilities
It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2018-1000030 It was...
USN-3817-1: Python vulnerabilities
It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2018-1000030 It was...
CVE-2018-18385
Asciidoctor in versions 1.5.8 allows remote attackers to cause a denial of service infinite loop. The loop was caused by the fact that Parser.nextblock was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detect...
django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc'
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions only one regular expression for Django...
django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html'
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a...
DEBIAN-CVE-2018-18385
Asciidoctor in versions 1.5.8 allows remote attackers to cause a denial of service infinite loop. The loop was caused by the fact that Parser.nextblock was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detect...
Apache Struts 2.0.x < 2.0.9 RCE (S2-001)
The version of Apache Struts running on the remote host is 2.0.x prior to 2.0.9. It, therefore, is affected by a possible remote code execution vulnerability when OGNL expressions are evaluated in a form field. Note that Nessus has not tested for these issues but has instead relied only on the...
Apache Struts 2.x < 2.2.3.1 RCE (S2-007)
The version of Apache Struts running on the remote host is 2.x prior to 2.2.3.1. It, therefore, is affected by a possible remote code execution vulnerability when user-supplied input is evaluated as an OGNL expressions when there is a conversion error. Note that Nessus has not tested for these...
Active Campaign Exploits Critical Apache Struts 2 Flaw in the Wild
It was only a matter of time before attacks were seen in the wild, and now it’s happened. A known threat actor has mounted a large cryptomining campaign using the recently disclosed Apache Struts 2 critical remote code-execution vulnerability. It uses a new malware designed for persistence and...
Policy Bypass
github.com/twistlock/authz is vulnerable to policy bypass attacks. The vulnerability exists due to the usage of weak regular expressions to control the access of docker commands through URL, allowing policy bypass attacks...
CVE-2018-16398
In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=/start to bypass a policy in which "docker start" is allowed but "docker pause" is not allowed...
CVE-2018-16398
In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=/start to bypass a policy in which "docker start" is allowed but "docker pause" is not allowed...
Code injection
In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=/start to bypass a policy in which "docker start" is allowed but "docker pause" is not allowed...
CVE-2018-16398
In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=/start to bypass a policy in which "docker start" is allowed but "docker pause" is not allowed...