UBUNTU-CVE-2022-23514

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

Regular Expression Denial Of Service (ReDoS)

loofah is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the attrnode.value attribute in the scrubattributes function of scrub.rb, allowing an attacker to crash the application by providing malicious SVG attributes...

Rails 安全漏洞

Rails is a set of open source web application frameworks based on the Ruby language from the American Rails team. A security vulnerability exists in Rails rails-html-sanitizer versions prior to 1.4.4, which stems from the use of inefficient regular expressions that are susceptible to excessive...

Loofah gem for Ruby 安全漏洞

The Loofah gem for Ruby is a Ruby-based library for processing and transforming HTML/XML documents. A security vulnerability exists in Loofah gem for Ruby prior to version 2.19.1, which stems from the inclusion of an inefficient regular expression that is susceptible to excessive backtracking whe...

Inefficient Regular Expression Complexity in rails-html-sanitizer

Summary Certain configurations of rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly...

GHSA-486F-HJJ9-9VHH Inefficient Regular Expression Complexity in Loofah

Summary Loofah = 2.19.1. Severity The Loofah maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly reported by @ooooooo-q...

Inefficient Regular Expression Complexity in rails-html-sanitizer

Summary Certain configurations of rails-html-sanitizer = 1.4.4...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to minimatch denial of service (CVE-2022-3517)

Summary Potential denial of service vulnerability in minimatch, CVE-2022-3517 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-3517 DESCRIPTION: minimatch is vulnerable to a denia...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities including those in Node.js, swagger, jQuery, Netty, Apache commons, validator.js, Chalk ansi-regex, Json-schema, Java SE and IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2021-4453...

Discourse < 2.8.14 Multiple Vulnerability

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

The vulnerability of the dialog plugin for the WYSIWYG editor CKEditor, which allows a hacker to trigger a service failure.

The vulnerability of the dialog plugin in the WYSIWYG editor CKEditor is related to an uncontrolled resource consumption during the processing of regular expressions for validation purposes. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Cookie.parse function, which uses an insecure regular expression. PoC js const CookieJar = require"cookiejar"; const jar = new CookieJar; const start = performance.now; const attack = "...

Vulnerability fixed in Exim

A vulnerability has been fixed in Exim. A malicious person at remote user could potentially exploit the vulnerability to cause a Denial-of-Service DoS attack. The way regular expressions are processed in configuration files processed can lead to a crash under certain circumstances. To do so, the...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Exim vulnerability (USN-5741-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5741-1 advisory. It was discovered that Exim incorrectly handled certain regular expressions. An attacker could use this issue to cause Exim to crash,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sccache (SUSE-SU-2022:4073-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4073-1 advisory. Updated to version 0.3.0: - CVE-2022-24713: Fixed Regex denial of service bsc1196972. -...

Denial Of Service (DoS)

exim4 is vulnerable to denial of service. The vulnerability exists in src/expand.c due to use after free in Regex Handler which allows an attacker to crash the application via malicious input...

PT-2022-7152

Name of the Vulnerable Software and Affected Versions Python Packaging Authority PyPA Wheel versions 0.37.1 and earlier Description The issue is related to an uncontrolled resource consumption in the Python Packaging Authority PyPA Wheel, which can be exploited by a remote attacker to cause a...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rustup (SUSE-SU-2022:3949-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3949-1 advisory. Updated to version 1.25.10: - CVE-2022-24713: Fixed Regex denial of service bsc1196972. -...

OESA-2022-2093 rubygem-websocket-extensions security update

Generic extension manager for WebSocket connections. Security Fixes: websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content ...

SUSE-SU-2022:3949-1 Security update for rustup

This update for rustup fixes the following issues: Updated to version 1.25.10: - CVE-2022-24713: Fixed Regex denial of service bsc1196972. - CVE-2021-45710: Fixed tokio data race with memory corruption bsc1194119...