CVE-2020-23469

CVE-2020-23469 affects gmate v0.12+bionic via a ReDoS vulnerability in the gedit3 plugin. The underlying issue is a regular-expression denial of service in the plugin, enabling potential denial of service conditions. Public references in the provided documents name gmate/gedit3 as the vulnerable ...

CVE-2020-23469

gmate v0.12+bionic contains a regular expression denial of service ReDoS vulnerability in the gedit3 plugin...

PT-2021-10901 · Unknown · Leo Editor

Name of the Vulnerable Software and Affected Versions: Leo Editor version 6.2.1 Description: The issue is related to a regular expression denial of service ReDoS vulnerability in the component plugins/importers/dart.py. This vulnerability was discovered in the Leo Editor. Recommendations: For Leo...

PT-2021-10900 · Gnome +1 · Gedit3 +1

Name of the Vulnerable Software and Affected Versions: gmate version 0.12+bionic Description: The issue is a regular expression denial of service ReDoS vulnerability in the gedit3 plugin. This vulnerability can cause a denial of service. Recommendations: For gmate version 0.12+bionic, at the...

CVE-2020-23478: Incorrect Comparison

Leo Editor v6.2.1 was discovered to contain a regular expression denial of service ReDoS vulnerability in the component plugins/importers/dart.py...

CVE-2020-23469: Undefined Security Weakness

gmate v0.12+bionic contains a regular expression denial of service ReDoS vulnerability in the gedit3 plugin...

CentOS 8 : nodejs:12 (CESA-2021:3623)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3623 advisory. - nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22930, CVE-2021-22940 - nodejs: Improper handling of untypical characters in domai...

Inefficient Regular Expression Complexity in tapjs/tap-mocha-reporter

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in tap-mocha-reporter. The ReDoS vulnerability is mainly due to the regex /^\s+|\s+$|/g and can be exploited with the following code. Proof of Concept // PoC.js var tapMochaReporter =...

nodejs:12 security and bug fix update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

Inefficient Regular Expression Complexity in validatorjs/validator.js

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in validator. It allows cause a denial of service when calling function 'rtrim'. The ReDoS vulnerability is mainly due to the regex /\s+$/g and can be exploited with the following code. Proof of Concept ...

Inefficient Regular Expression Complexity in nth-check

There is a Regular Expression Denial of Service ReDoS vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks. The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s?:+-?\s\d+? with quantified overlapping adjacency and can be...

GHSA-RP65-9CF3-CJXR Inefficient Regular Expression Complexity in nth-check

There is a Regular Expression Denial of Service ReDoS vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks. The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s?:+-?\s\d+? with quantified overlapping adjacency and can be...

prismjs Regular Expression Denial of Service vulnerability

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU...

@21epub/resource-lib (>=1.0.0, <=1.0.3), @2fn/helpers (>=1.0.0, <=1.0.1) +3319 more potentially affected by CVE-2021-3801 via prismjs (>=1.2.0, <=1.24.1)

prismjs NPM version =1.2.0, =1.0.0, =1.0.0, =1.0.23, =1.0.1, =1.2.0, =1.0.0, =1.1.4, =1.16.0, =1.1.2, =0.5.19-20200320212412, =1.0.0-beta.10, =1.0.0-beta.14 - @adebawo-damilare/esm-reports-app 5.2.0 - @admin-bro/design-system 1.4.0 - @afzalh/aug07 1.1.2 and more Source cves: CVE-2021-3801 Source...

GHSA-HQHP-5P83-HX96 prismjs Regular Expression Denial of Service vulnerability

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU...

@nice-move/cli (>=0.5.13, <=0.5.21), @nice-move/init (>=0.1.12, <=0.2.4) +4 more potentially affected by CVE-2021-3795 via semver-regex (>=3.0.0, <=3.1.2)

semver-regex NPM version =3.0.0, =0.5.13, =0.1.12, =2.7.0, =1.2.0, =1.2.3 Source cves: CVE-2021-3795 Source advisory: OSV:GHSA-44C6-4V22-4MHX...

Inefficient Regular Expression Complexity in vuelidate

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an...

GHSA-VVF2-PPJ9-PP49 Inefficient Regular Expression Complexity in vuelidate

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an...

abt.api.web (0.0.3) potentially affected by CVE-2021-3807 via ansi-regex (3.0.0)

ansi-regex NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - abt.api.web 0.0.3 Source cves: CVE-2021-3807 Source advisory: OSV:GHSA-93Q8-GQ69-WQMW...

@bdehamer/foo-a (>=0.1.0, <=0.1.1), @platform/cell.cli (0.2.277) +10 more potentially affected by CVE-2021-3807 via ansi-regex (6.0.0)

ansi-regex NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - @bdehamer/foo-a =0.1.0, =0.1.1 - @platform/cell.cli 0.2.277 - @platform/cell.fs.sync 0.3.273 - @platform/cell.service 0.8.41 -...