4062 matches found
Regular Expression Denial of Service in npm-user-validate
npm-user-validate before version 1.0.1 is vulnerable to a Regular Expression Denial of Service REDos. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. Impact The issue affects the email function. If you use this function to...
2cs-basecode (>=0.1.0, <=0.1.1), 8bit-ghost-ui (>=1.0.0-beta.1, <=1.0.0-beta.3) +345 more potentially affected by CVE-2020-7746 via chart.js (>=2.0.0, <=2.9.3)
chart.js NPM version =2.0.0, =0.1.0, =1.0.0-beta.1, =1.0.3, =1.0.0, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =1.0.0, =7.0.1, =0.0.1-alpha.3,...
Denial of Service in locutusjs/locutus
Description locutus is vulnerable to ReDoS. The regular expression at src/php/network/inetpton.js:24 is vulnerable to ReDoS. It is possible to cause increasing slow-downs which lock the event loop by passing strings which have some number of repeating a characters followed by a . character. For...
Regular Expression Denial Of Service (ReDoS)
dat.gui is vulnerable to regular expression denial of service. The sub-pattern \s.+\s in interpret.js and can be exploited to cause a denial of service...
02strich-markdown (>=1.0.0, <=1.0.2), 10secondsofcode-custom (1.0.0) +11505 more potentially affected by CVE-2020-7753 via trim (0.0.1)
trim NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on trim and may be impacted: - 02strich-markdown =1.0.0, =1.0.0, =0.0.2, =0.0.1, =4.11.0, =0.1.0, =0.0.2, =0.2.0, =1.0.16, =1.2.0, =1.2.2 and more Source cves: CVE-2020-7753 Source...
CS Money: ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)
Summary: The endpoint /graphql has a vulnerable query operation named "search", that can I send a Regex malformed parameter, in order to trick the original regular expression to a regex bomb expression. + Payload with a "common" search, querying the value "AAA": query a searchq: "AAA", lang: "en"...
Oracle Linux 7 : python3 (ELSA-2020-3888)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3888 advisory. - Security fix for CVE-2020-8492 Resolves: rhbz1810616 - Security fix for CVE-2019-16935 Resolves: rhbz1797999 Tenable has extracted the preceding...
CVE-2019-20922
Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...
CVE-2019-20922
Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...
Design/Logic Flaw
Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...
CVE-2019-20922
CVE-2019-20922 affects the Handlebars.js template engine before 4.4.5. The vulnerability stems from an eager RegExp matching approach in the parser, which can be forced into an endless loop by crafted templates, leading to resource exhaustion. Impact is described as denial of service via consumed...
CVE-2019-20922
Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...
CVE-2019-20922
Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...
RHEL 7 : python3 (RHSA-2020:3888)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3888 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
Regular Expression Denial of Service (ReDoS)
Overview Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. The ReDoS vulnerability ...
FreeBSD : Python -- multiple vulnerabilities (2cb21232-fb32-11ea-a929-a4bf014bf5f7)
Python reports : bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest.... bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and...
Regular Expression Denial Of Service (ReDoS)
ua-parser-js is vulnerable to regular expression denial of service. A remote attacker is able to cause a denial of service condition by submitting a malicious string that when parsed via the Redmi and Mi Pad regexes, would result in excessive resource consumption...
CVE-2020-7733
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...
CVE-2020-7733
CVE-2020-7733 affects ua-parser-js prior to 0.7.22, where the Redmi/Mi UA regex can cause a Regular Expression Denial of Service (ReDoS). This may allow a crafted request to trigger a DoS on affected environments. Remediation: upgrade ua-parser-js to 0.7.22 or newer (as per description). If any d...