5799 matches found
PT-2023-35925 · Oracle · Java.Base
Name of the Vulnerable Software and Affected Versions: java.base affected versions not specified Description: A security exception crash has been reported in java.base. The crash occurs in the java.util.regex.Pattern class, specifically in the Loop.match, GroupTail.match, and BranchConn.match...
PT-2023-35926 · Oracle · Java
Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: The issue is related to a security exception in the Java java.util.regex package, specifically in the Pattern$GroupTail.match function. The crash occurs when the BufferedWriter attempts to wri...
feign:BodyTemplateFuzzer: Security exception in java.base/java.util.regex.Pattern$GroupTail.match
Project: https://github.com/openfeign/feign.git Detailed Report: https://oss-fuzz.com/testcase?key=5307352335908864 Project: feign Fuzzing Engine: libFuzzer Fuzz Target: BodyTemplateFuzzer Job Type: libfuzzerasanfeign Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
apache-commons-io:InputXmlFuzzer: Security exception in java.base/java.util.regex.Pattern$Loop.match
Detailed Report: https://oss-fuzz.com/testcase?key=5305025839366144 Project: apache-commons-io Fuzzing Engine: libFuzzer Fuzz Target: InputXmlFuzzer Job Type: libfuzzerasanapache-commons-io Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
GHSA-WVP2-9PPW-337J Paths contain matrix variables bypass decorators
Impact Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. In this situation, the Armeria decorators might not invoked because of the matrix variables. Let's see the...
Denial Of Service (DoS)
gitlab is vulnerable to Denial Of Service DoS. A malicious attacker is able to exploit a regex issue in the submodule URL parser to cause a denial of service due to inefficient regular expression complexity...
Denial Of Service (DoS)
gitlab is vulnerable to Denial of Service DoS attacks. Due to a regex check, the API for changing asset links produced backtracks, resulting in significant CPU consumption for some user-supplied values, causing the application to crash...
Denial Of Service (DoS)
gitlab is vulnerable to Denial of Service DoS attacks. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string, resulting in an application crash...
The vulnerability of the Ruby programming language’s URI component lies in the use of a regular expression c, which has an inefficient computational cost. This allows attackers to trigger a service failure.
The vulnerability of the Ruby programming language’s URI component is related to the incorrect handling of invalid URL addresses. Exploiting this vulnerability allows a remote attacker to cause service failures...
joni:RegexMatcherFuzzer: Security exception in org.joni.Parser.parseEnclose
Project: https://github.com/jruby/joni.git Detailed Report: https://oss-fuzz.com/testcase?key=4655154480414720 Project: joni Fuzzing Engine: libFuzzer Fuzz Target: RegexMatcherFuzzer Job Type: libfuzzerasanjoni Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
PCRE2 输入验证错误漏洞
PCRE2 is PCRE2Project open source set of C functions. Use the same syntax and semantics as Perl5 to achieve regular expression pattern matching . A security vulnerability exists in PCRE2 versions prior to 10.41, which stems from an integer overflow problem in pcre2test that allows an attacker to...
UBUNTU-CVE-2023-3424
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the...
is_js vulnerable to Regular Expression Denial of Service
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...
Django 安全漏洞
Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper , view system , template system and so on. A security vulnerability exists in Django versions prior to 3.2.20, 4.1.10, and 4.2.3, which...
Regular Expression Denial Of Service (ReDoS)
uri is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists due to inefficient Regex pattern complexity used in rfc2396parser.rb and rfc3986parser.rb., which allows an attacker to crash the application by providing maliciously crafted URI patterns. NOTE: This issue...
Regular Expression Denial Of Service (ReDoS)
semver is vulnerable to Regular Expression Denial Of Service ReDoS attacks. A malicious user is able to cause parsing slowdowns when untrusted user data is provided as a range via the function parseRange due to the usage of regex expression with inefficient time complexity...
clamav:clamav_dbload_CDB_fuzzer: Memcpy-param-overlap in repeat
Detailed Report: https://oss-fuzz.com/testcase?key=5986352567812096 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavdbloadCDBfuzzer Job Type: libfuzzerasanclamav Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address: 0x798c50b14d40,0x798c538cf710 and 0x798c4dd5a378,...
PT-2023-4760
Name of the Vulnerable Software and Affected Versions word-wrap versions all Description The issue is related to the use of a regular expression with inefficient computational complexity in the word-wrap module of the Node.js platform. This can be exploited by a remote attacker to cause a denial ...
SUSE SLES15: bind / bind-chrootenv / bind-devel / bind-devel-32bit / bind-doc / etc (SUSE-SU-2023:2578-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2578-1 advisory. bind: - Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro - There are no source...