generator-jhipster vulnerable to login check Regular Expression Denial of Service

Impact For applications using JWT or session-based authentication not OIDC, users can input a login string which can cause a denial of service, as parsing it will be too complex. Here is an example: https://gist.github.com/atomfrede/311f8a9c6eb74c5c5226af0481155207 The vulnerable expression was...

Allocation of Resources Without Limits or Throttling

Overview std/regexp/syntax is a Go standard library package std/regexp/syntax Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:Programs which compile regular expressions from untrusted sources may be vulnerable to...

CVE-2022-39280 Regular expression denial of service in dparse

dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version...

PT-2022-26045

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description Programs that compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp...

Design/Logic Flaw

Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service...

CVE-2022-34428

Dell Hybrid Client (pre-1.8) contains a Regular Expression Denial of Service vulnerability in the UI. An attacker with WMS group admin access could exploit the improper regex to cause a temporary DoS. A remediation is available: upgrade to version 1.8 or later. The affected component is the UI ha...

DEBIAN-CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

Rocket.Chat actionLinkHandler Information Disclosure Vulnerability

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an information disclosure vulnerability that stems from the actionLinkHandler method allowing message ID enumeration using a Regex MongoDB query. An attacker can exploit the vulnerability to obtain sensitive information...

ReDoS issue in dparse

Impact dparse versions prior to 0.5.1 contain a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. All users parsing index server URLs with dparse are impacted by this vulnerability. Patches The Patch is applied in the 0.5.2 version, all users are recommended to...

CVE-2022-32228

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs...

CVE-2022-32218

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries...

Information disclosure

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries...

CVE-2022-32218

CVE-2022-32218 – Rocket.Chat information disclosure : The vulnerability stems from actionLinkHandler/ actionLinks.getMessage not validating input, allowing authenticated users to enumerate Message IDs via a regex MongoDB query. Impact: potential exposure of sensitive information by enumerating ex...

CVE-2022-32228

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs...

CVE-2022-32218

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries...

CVE-2022-32228

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs...

Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in Rocket.Chat versions prior to 4.7.5, 4.8.0 and later, and prior to 4.8.2, which stems from a failure of the getReadReceipts Meteor server method to correctly filter user input passed to a MongoDB...

The vulnerability of the AbstractBasicAuthHandler class in the urllib.request component of the Python programming language allows a hacker to trigger a denial-of-service attack.

The vulnerability of the AbstractBasicAuthHandler class in the urllib.request component of the Python programming language is related to the use of an inefficient regular expression. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

SUSE-SU-2022:3310-1 Security update for tika-core

This update for tika-core fixes the following issues: - CVE-2022-33879: Incomplete fix and new regex DoS in StandardsExtractingContentHandler. bsc1201217 - CVE-2022-30973, CVE-2022-30126: Regular Expression Denial of Service in Standards Extractor. bsc1199604, bsc1200283...

GHSA-V973-FXGF-6XHP mako is vulnerable to Regular Expression Denial of Service

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin...