GHSA-RP65-9CF3-CJXR Inefficient Regular Expression Complexity in nth-check

There is a Regular Expression Denial of Service ReDoS vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks. The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s?:+-?\s\d+? with quantified overlapping adjacency and can be...

prismjs Regular Expression Denial of Service vulnerability

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU...

@21epub/resource-lib (>=1.0.0, <=1.0.3), @2fn/helpers (>=1.0.0, <=1.0.1) +3321 more potentially affected by CVE-2021-3801 via prismjs (>=1.2.0, <=1.24.1)

prismjs NPM version =1.2.0, =1.0.0, =1.0.0, =1.0.23, =1.0.1, =1.2.0, =1.0.0, =1.1.4, =1.16.0, =1.1.2, =0.5.19-20200320212412, =1.0.0-beta.10, =1.0.0-beta.14 - @ada87/hexo-prism-plugin 2.3.0 - @adebawo-damilare/esm-reports-app 5.2.0 - @admin-bro/design-system 1.4.0 and more Source cves:...

GHSA-HQHP-5P83-HX96 prismjs Regular Expression Denial of Service vulnerability

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU...

@nice-move/cli (>=0.5.13, <=0.5.21), @nice-move/init (>=0.1.12, <=0.2.4) +4 more potentially affected by CVE-2021-3795 via semver-regex (>=3.0.0, <=3.1.2)

semver-regex NPM version =3.0.0, =0.5.13, =0.1.12, =2.7.0, =1.2.0, =1.2.3 Source cves: CVE-2021-3795 Source advisory: OSV:GHSA-44C6-4V22-4MHX...

Inefficient Regular Expression Complexity in vuelidate

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an...

GHSA-VVF2-PPJ9-PP49 Inefficient Regular Expression Complexity in vuelidate

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an...

@asiachan/ui-h5 (>=0.0.1, <=0.0.12), @asiachan/ui-h5-test (0.0.1) +57 more potentially affected by CVE-2021-3807 via ansi-regex (5.0.0)

ansi-regex NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - @asiachan/ui-h5 =0.0.1, =0.2.16, =3.0.1-1.0, =1.0.0, =2.1.6, =0.0.0, =0.0.25, =0.0.0, =0.0.19, =0.8.5, =0.8.40 and more Source cves:...

@codedungeon/gunner (>=0.38.0, <=0.80.1), @codedungeon/laravel-versions-cli (0.1.0) +22 more potentially affected by CVE-2021-3807 via ansi-regex (>=4.0.0, <=4.1.0)

ansi-regex NPM version =4.0.0, =0.38.0, =0.0.65, =0.0.0, =0.0.41, =0.0.12, =0.0.0, =0.2.0, =3.3.69, =0.0.3, =0.2.11, =5.1.0, =4.0.58, =3.0.58, =6.0.17, =6.1.110 and more Source cves: CVE-2021-3807 Source advisory: OSV:GHSA-93Q8-GQ69-WQMW...

@bdehamer/foo-a (>=0.1.0, <=0.1.1), @platform/cell.cli (0.2.277) +10 more potentially affected by CVE-2021-3807 via ansi-regex (6.0.0)

ansi-regex NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - @bdehamer/foo-a =0.1.0, =0.1.1 - @platform/cell.cli 0.2.277 - @platform/cell.fs.sync 0.3.273 - @platform/cell.service 0.8.41 -...

Inefficient Regular Expression Complexity in chalk/ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes. Proof of Concept js import ansiRegex from 'ansi-regex'; forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = "\u001B"+";".repeati10000...

abt.api.web (0.0.3) potentially affected by CVE-2021-3807 via ansi-regex (3.0.0)

ansi-regex NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansi-regex and may be impacted: - abt.api.web 0.0.3 Source cves: CVE-2021-3807 Source advisory: OSV:GHSA-93Q8-GQ69-WQMW...

CVE-2021-32839

A resource-consumption flaw was found in python-sqlparse. The formatter function that strips comments from SQL contains a regular expression that is vulnerable to Regular Expression Denial of Service ReDoS. A network attacker could craft an SQL comment containing numerous repetitions of '\r\n' th...

CVE-2021-32838

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...

Design/Logic Flaw

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...

PYSEC-2021-325

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...

CVE-2021-32838

CVE-2021-32838 : Flask-RESTX (flask-restx) before 0.5.1 is vulnerable to a Regular Expression Denial of Service (ReDoS) in email_regex. The issue is fixed in version 0.5.1. Affected: Flask-RESTX prior to 0.5.1. Impact details are limited to what the description states; no exploitation or scope be...

CVE-2021-32838 Regular Expression Denial of Service in flask-restx

Flask-RESTX pypi package flask-restx is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS Regular Expression Denial of Service in emailregex. This is fixed in version 0.5.1...

Inefficient Regular Expression Complexity in ampproject/amphtml

✍️ Description The amphtml package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted template as input to the expandTemplate function of core/types/string/index.js may cause an application to consume an excessive amount of CPU. Below pinned...

Inefficient Regular Expression Complexity in alvations/sacremoses

✍️ Description The sacremoses package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted text as input to the hasnumericonly function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex...