PT-2021-11398

Name of the Vulnerable Software and Affected Versions: Prototype version 1.7.3 Description: An issue was discovered in the stripTags and unescapeHTML components where an attacker can cause a Regular Expression Denial of Service ReDOS through stripping crafted HTML tags. Recommendations: For...

Updated python-pygments packages fix a security vulnerability

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service...

SUSE SLES11 Security Update : python (SUSE-SU-2020:14306-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2020:14306-1 advisory. - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular...

SUSE SLES11 Security Update : python-Jinja2 (SUSE-SU-2021:14644-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:14644-1 advisory. - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use ...

Regular Expression Denial Of Service (ReDoS)

locutus is vulnerable to regular expression denial of service ReDoS. An attacker is able to cause a denial of service condition via the gopherparsedir feature...

Regular Expression Denial of Service

Overview normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 has a ReDoS regular expression denial of service issue because it has exponential performance for data: URLs. Recommendation Upgrade to versions 4.5.1, 5.3.1, 6.0.1 or later References - CVE - GitHub Advisory...

@dylanlindgren/storybook-addon-sn-next-ui (2.0.0), @github1/ajax-service (>=0.4.0-next.0, <=0.4.44) +48 more potentially affected by CVE-2021-33502 via normalize-url (>=4.3.0, <=4.5.0)

normalize-url NPM version =4.3.0, =0.4.0-next.0, =0.4.39-next.0, =5.1.0, =5.7.5 - @plaa/metascraper 5.4.0 - @plaa/metascraper-amazon 5.4.0 - @plaa/metascraper-audio 5.4.0 - @plaa/metascraper-author 5.4.0 - @plaa/metascraper-date 5.4.0 - @plaa/metascraper-description 5.4.0 -...

@cumulus/api-client (1.19.0), @github1/ajax-service (>=0.4.0, <=0.4.55) +55 more potentially affected by CVE-2021-33502 via normalize-url (>=5.0.0, <=5.3.0)

normalize-url NPM version =5.0.0, =0.4.0, =1.0.1, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =1.0.1, =0.8.7, =0.8.0, =0.8.0, =1.0.1, =0.8.0, =0.8.97 and more Source cves: CVE-2021-33502 Source advisory: OSV:GHSA-PX4H-XG32-Q955...

@pixelastic/videogames-helper (>=0.2.2, <=0.2.3), aberlaas (>=1.21.0, <=1.23.0) +6 more potentially affected by CVE-2021-33502 via normalize-url (6.0.0)

normalize-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on normalize-url and may be impacted: - @pixelastic/videogames-helper =0.2.2, =1.21.0, =2.13.0, =2.3.0, =4.0.0, =5.0.0 - pietro 0.6.1 Source cves: CVE-2021-33502 Source...

ReDoS in normalize-url

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data: URLs...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

Design/Logic Flaw

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

CVE-2021-23392

The issue affects locutus (JavaScript/Node.js package) before version 2.0.15, where the gopher_parsedir function is vulnerable to Regular Expression Denial of Service (ReDoS). The root cause is a flaw in gopher_parsedir that can be exploited to cause high CPU/denial by crafted input. The recommen...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

PT-2021-15486

Name of the Vulnerable Software and Affected Versions locutus versions prior to 2.0.15 Description The issue concerns a Regular Expression Denial of Service ReDoS vulnerability via the gopher parsedir function. This can lead to a denial of service. Recommendations For versions prior to 2.0.15,...

CVE-2021-23392: Undefined Security Weakness

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

Regular Expression Denial of Service

Overview trim-newlines before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method. Recommendation Upgrade to versions 3.0.1 or 4.0.1 or later References - CVE - GitHub Advisory...

GHSA-7P7H-4MM5-852V Uncontrolled Resource Consumption in trim-newlines

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...

Uncontrolled Resource Consumption in trim-newlines

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...