CVE-2024-28864 [TagAwareCipher] - Decryption Failure (Regex Match)

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

CVE-2024-28864

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

CVE-2024-28864 [TagAwareCipher] - Decryption Failure (Regex Match)

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

CVE-2024-28864

CVE-2024-28864 affects the PHP library SecureProps (versions 1.2.0 and 1.2.1). The issue arises when encrypted data is encoded with NullEncoder and fed into TagAwareCipher ; a regex fails to detect tags (especially with special characters such as “\n”), causing the decryption to be skipped and th...

CVE-2024-28864 [TagAwareCipher] - Decryption Failure (Regex Match)

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

GHSA-RJ29-J2G4-77Q8 [TagAwareCipher] - Decryption Failure (Regex Match)

Impact Vulnerability in SecureProps involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with NullEncoder and passed to TagAwareCipher, and contains special characters such as \n. As a result, the decryption process is...

[TagAwareCipher] - Decryption Failure (Regex Match)

Impact Vulnerability in SecureProps involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with NullEncoder and passed to TagAwareCipher, and contains special characters such as \n. As a result, the decryption process is...

SecureProps Security Vulnerabilities

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A security vulnerability exists in SecureProps versions 1.2.0 and 1.2.1, which stems from the inability of regular expressions to detect tags during the decryption of encrypted data, which...

CVE-2024-28864: Inefficient Regular Expression Complexity

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

jsoup:HtmlFuzzer: Security exception in java.base/java.util.regex.Pattern$Loop.match

Project: https://github.com/jhy/jsoup.git Detailed Report: https://oss-fuzz.com/testcase?key=5846721227718656 Project: jsoup Fuzzing Engine: libFuzzer Fuzz Target: HtmlFuzzer Job Type: libfuzzerasanjsoup Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

CVE-2024-27351

The Django web framework is vulnerable to a Regular Expression Denial-of-Service (ReDoS) attack. The issue resides in the django.utils.text.Truncator.words() method when html=True is set, as well as the truncatewords_html template filter. This vulnerability persists due to an incomplete fix for C...

CVE-2024-27351

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because ...

OESA-2024-1254 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewordshtml filter of Django. This issue may allow an attacker to use a...

BIT-GITLAB-2020-26414

An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string...

BIT-GITLAB-2021-39938

A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted...

BIT-GITLAB-2022-3514

An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the...

BIT-GITLAB-2022-4131

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the...

BIT-GITLAB-2023-0632 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry...

BIT-PARSE-2020-5251 Information disclosure in parse-server

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way...

BIT-OPENPROJECT-2021-32763

OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the MessagesController class of OpenProject has a quote method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip tags from the message being quote...