4890 matches found
PT-2021-3401
Name of the Vulnerable Software and Affected Versions IS-SVG versions 2.1.0 through 4.3.1 Description The issue is related to a Regular Expression Denial of Service ReDOS that occurs when the application checks a crafted invalid SVG string. This can lead to unlimited memory allocation, potentiall...
CVE-2021-29059: Allocation of Resources Without Limits or Throttling
A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service ReDOS occurs if the application is provided and checks a crafted invalid SVG string...
@antlerengineering/components (>=2.4.0, <=2.10.3), @antlerengineering/form-builder (>=2.1.7, <=2.4.1) +75 more potentially affected by CVE-2021-23411 via anchorme (>=0.7.2, <=3.0.8)
anchorme NPM version =0.7.2, =2.4.0, =2.1.7, =2.10.4, =0.2.2, =0.2.2, =0.6.22, =0.0.1, =2.1.0-rc1, =0.0.1, =12.4.0, =0.7.11, =0.6.100, =0.6.100, =0.6.6, =1.1.9, =1.1.14 and more Source cves: CVE-2021-23411 Source advisory: SNYK:JS-ANCHORME-1311008...
PT-2021-11398
Name of the Vulnerable Software and Affected Versions: Prototype version 1.7.3 Description: An issue was discovered in the stripTags and unescapeHTML components where an attacker can cause a Regular Expression Denial of Service ReDOS through stripping crafted HTML tags. Recommendations: For...
Updated python-pygments packages fix a security vulnerability
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service...
SUSE SLES11 Security Update : python (SUSE-SU-2020:14306-1)
The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2020:14306-1 advisory. - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular...
SUSE SLES11 Security Update : python-Jinja2 (SUSE-SU-2021:14644-1)
The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:14644-1 advisory. - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use ...
Regular Expression Denial Of Service (ReDoS)
locutus is vulnerable to regular expression denial of service ReDoS. An attacker is able to cause a denial of service condition via the gopherparsedir feature...
Regular Expression Denial of Service
Overview normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 has a ReDoS regular expression denial of service issue because it has exponential performance for data: URLs. Recommendation Upgrade to versions 4.5.1, 5.3.1, 6.0.1 or later References - CVE - GitHub Advisory...
@dylanlindgren/storybook-addon-sn-next-ui (2.0.0), @github1/ajax-service (>=0.4.0-next.0, <=0.4.44) +48 more potentially affected by CVE-2021-33502 via normalize-url (>=4.3.0, <=4.5.0)
normalize-url NPM version =4.3.0, =0.4.0-next.0, =0.4.39-next.0, =5.1.0, =5.7.5 - @plaa/metascraper 5.4.0 - @plaa/metascraper-amazon 5.4.0 - @plaa/metascraper-audio 5.4.0 - @plaa/metascraper-author 5.4.0 - @plaa/metascraper-date 5.4.0 - @plaa/metascraper-description 5.4.0 -...
ReDoS in normalize-url
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data: URLs...
@cumulus/api-client (1.19.0), @github1/ajax-service (>=0.4.0, <=0.4.55) +55 more potentially affected by CVE-2021-33502 via normalize-url (>=5.0.0, <=5.3.0)
normalize-url NPM version =5.0.0, =0.4.0, =1.0.1, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =1.0.1, =0.8.7, =0.8.0, =0.8.0, =1.0.1, =0.8.0, =0.8.97 and more Source cves: CVE-2021-33502 Source advisory: OSV:GHSA-PX4H-XG32-Q955...
@pixelastic/videogames-helper (>=0.2.2, <=0.2.3), aberlaas (>=1.21.0, <=1.23.0) +6 more potentially affected by CVE-2021-33502 via normalize-url (6.0.0)
normalize-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on normalize-url and may be impacted: - @pixelastic/videogames-helper =0.2.2, =1.21.0, =2.13.0, =2.3.0, =4.0.0, =5.0.0 - pietro 0.6.1 Source cves: CVE-2021-33502 Source...
CVE-2021-23392
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...
CVE-2021-23392
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...
Design/Logic Flaw
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...
CVE-2021-23392
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...
CVE-2021-23392
The issue affects locutus (JavaScript/Node.js package) before version 2.0.15, where the gopher_parsedir function is vulnerable to Regular Expression Denial of Service (ReDoS). The root cause is a flaw in gopher_parsedir that can be exploited to cause high CPU/denial by crafted input. The recommen...
PT-2021-15486
Name of the Vulnerable Software and Affected Versions locutus versions prior to 2.0.15 Description The issue concerns a Regular Expression Denial of Service ReDoS vulnerability via the gopher parsedir function. This can lead to a denial of service. Recommendations For versions prior to 2.0.15,...