@appium/universal-xml-plugin (>=1.0.18, <=1.0.20), @cardscan.ai/cardscan-client (>=0.1.0, <=0.4.3) +103 more potentially affected by CVE-2024-41818 via fast-xml-parser (>=4.3.5, <=4.4.0)

fast-xml-parser NPM version =4.3.5, =1.0.18, =0.1.0, =1.1.0, =8.0.167, =11.49.0, =13.4.12, =11.49.0, =28.16.23, =11.49.0, =0.0.145, =1.0.0, =10.3.11, =0.1.11, =8.0.167, =5.0.167, =5.0.200 and more Source cves: CVE-2024-41818 Source advisory: OSV:GHSA-MPG4-RC92-VX8V...

GHSA-MPG4-RC92-VX8V fast-xml-parser vulnerable to ReDOS at currency parsing

Summary A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team. Details https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.jsL10 contains a vulnerable regex PoC pass the following string '\t'.repeat13337 + '.' Impact Denial o...

CVE-2024-41818

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1...

CVE-2024-41818

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1...

CVE-2024-41818

Technical details about CVE-2024-41818 are not provided in the connected documents. The initial entry notes a ReDoS in currency.js fixed in 4.4.1. Monitor for updates.

CVE-2024-41818 ReDOS at currency parsing fast-xml-parser

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1...

CVE-2024-41818 ReDOS at currency parsing fast-xml-parser

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1...

CVE-2024-41818 ReDOS at currency parsing fast-xml-parser

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1...

fast-xml-parser 安全漏洞

fast-xml-parser is an open source library from Natural Intelligence. It is used to quickly validate XML, parse XML and build XML without C/C++ based libraries and callbacks. A security vulnerability exists in fast-xml-parser version v4.2.4. An attacker could use this vulnerability to cause a deni...

PT-2024-29584

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions prior to 4.4.1 Description A ReDOS issue exists in the currency.js component of the fast-xml-parser library, specifically affecting the experimental version 5. This issue can cause a denial of service during currency...

Exploit for Path Traversal in Jenkins

CVE-2024-23897 Because of a misconfiguration of a default o...

CVE-2024-41818

creationtimestamp| type| source ---|---|--- 2024-07-28 00:58:52+00:00| published-proof-of-concept| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v...

Malicious code in interasdasdnal-data-parser (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2abe44e01cf210338171b5fbd85494df086f85ce231b21c53c5b741dd960d355 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6525 Malicious code in interasdasdnal-data-parser (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2abe44e01cf210338171b5fbd85494df086f85ce231b21c53c5b741dd960d355 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

PT-2024-40827 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: A security exception crash has been reported. The crash involves the com.github.javaparser.GeneratedJavaParser.Expression and java.base/java.lang.StringUTF16.compress functions, as well as the...

CVE-2024-6197

A vulnerability was found in cURL's utf8asn1str function in the ASN1 parser, which causes a denial of service due to a memory allocation flaw. This flaw allows a remote attacker to use a specially crafted TLS certificate, causing the function to invoke free on a 4-byte local stack buffer. While...

The vulnerability of the SKP File Parser component in the 3D design software Substance 3D Stager allows a hacker to execute arbitrary code.

The vulnerability of the SKP File Parser component in the 3D design software Substance 3D Stager relates to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-41662 VNote vulnerable to Markdown XSS, which leads to RCE

VNote is a note-taking platform. A Cross-Site Scripting XSS vulnerability has been identified in the Markdown rendering functionality of versions 3.18.1 and prior of the VNote note-taking application. This vulnerability allows the injection and execution of arbitrary JavaScript code through which...

CVE-2024-41662 VNote vulnerable to Markdown XSS, which leads to RCE

VNote is a note-taking platform. A Cross-Site Scripting XSS vulnerability has been identified in the Markdown rendering functionality of versions 3.18.1 and prior of the VNote note-taking application. This vulnerability allows the injection and execution of arbitrary JavaScript code through which...

DEBIAN-CVE-2024-6197

libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes free on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort...