124 matches found
moment: inefficient parsing algorithm resulting in DoS
A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service ReDoS attacks...
Ubuntu: Security Advisory (USN-5559-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-5559-1: Moment.js vulnerabilities
It was discovered that Moment.js incorrectly handled certain input paths. An attacker could possibly use this issue to cause a loss of integrity by changing the correct path to one of their choice. CVE-2022-24785 It was discovered that Moment.js incorrectly handled certain input. An attacker coul...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Moment.js vulnerabilities (USN-5559-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5559-1 advisory. It was discovered that Moment.js incorrectly handled certain input paths. An attacker could possibly use this issue to cause a lo...
Tenable SecurityCenter < 5.22.0 Multiple Vulnerabilities (TNS-2022-15)
According to its self-reported version, the Tenable SecurityCenter application installed on the remote host has a third-party software vulnerability in Moment.js, prior to version 2.29.4. It contains a denial of service vulnerability due to an inefficient parsing algorithm. An remote attacker can...
[R1] Tenable.sc 5.22.0 Fixes One Third-Party Vulnerability
R1 Tenable.sc 5.22.0 Fixes One Third-Party Vulnerability Arnie Cabral Wed, 07/27/2022 - 18:26 Tenable.sc leverages third-party software to help provide underlying functionality. One of the third-party components moment.js was found to contain vulnerabilities, and updated versions have been made...
Moment.js 2.18.x < 2.29.4 Regular Expression Denial of Service
According to its self-reported version number, Moment.js is 2.18.x prior to 2.29.4. Therefore, it may be affected by a regular expression denial of service vulnerability via the preprocessRFC2822 function in from-string.js, when processing a very long crafted string. Note that the scanner has not...
CVE-2022-31129
A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service ReDoS attacks...
GHSA-WC69-RHJR-HC9G Moment.js vulnerable to Inefficient Regular Expression Complexity
Impact using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has quadratic N^2 complexity on specific inputs noticeable slowdown is observed with inputs above 10k characters users who pass user-provided strings without sanity length checks to moment...
Moment.js vulnerable to Inefficient Regular Expression Complexity
Impact using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has quadratic N^2 complexity on specific inputs noticeable slowdown is observed with inputs above 10k characters users who pass user-provided strings without sanity length checks to moment...
CVE-2022-31129
Moment.js (JavaScript date library) contains a vulnerability in string-to-date parsing via RFC2822 parsing, causing quadratic (N^2) complexity and potential (Re)DoS for long inputs (>10k chars). The issue is mitigated by upgrading to Moment.js v2.29.4 or later; if upgrading is not possible, li...
PT-2022-20550
Name of the Vulnerable Software and Affected Versions moment versions prior to 2.29.4 Description The issue is related to an inefficient parsing algorithm used in the moment JavaScript date library, specifically in the string-to-date parsing and rfc2822 parsing. This results in quadratic complexi...
Atlassian Jira < 8.20.9 / 8.22.0 (JRASERVER-73244)
The version of Atlassian Jira installed on the remote host is prior to 8.20.9 / 8.22.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73244 advisory. - Outdated Moment.js in Jira Server CVE-2017-18214, CVE-2016-4055 CVE-2017-18214 Note that Nessus has not tested for...
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.3 Containers security update
Red Hat OpenShift Service Mesh 2.1.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...
Security Bulletin: IBM Db2 Mirror for i is vulnerable to directory traversal due to Moment.js (CVE-2022-24785)
Summary The IBM Db2 Mirror for i GUI uses Chart.js for data presentation and charting features. The version of Chart.js used by IBM Db2 Mirror for i depends upon Moment.js which is vulnerable to CVE-2022-24785 as described in the vulnerability details section. IBM has addressed the vulnerability...
Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.5.0 is now generally available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Moment.js: Path traversal in moment.locale
A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...
Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote attack due to Moment.js CVE-2022-24785
Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote attack due to Moment.js CVE-2022-24785 with details below Vulnerability Details CVEID:CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attacker to traverse directories on the system, caused by improper...
Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.4.4 General Availability release images. This update provides security fixes, bug fixes, and updates container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System...
CVE-2022-24785
A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...