3388 matches found
GHSA-93GM-QMQ6-W238 Duplicate Advisory: Starlette Content-Type Header ReDoS
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2jv5-9r88-3w3p. This link is maintained to preserve external references. Original Description Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header,...
CVE-2024-24762
CVE-2024-24762 affects python-multipart and describes a ReDoS in parsing the HTTP Content-Type header (options). An attacker can send a crafted Content-Type to exhaust CPU and stall the event loop. The vulnerability is fixed in version 0.0.7 by upstream patching the regex. Remediation is to upgra...
Fedora 38 : mingw-python-pygments (2024-db87ce2a47)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-db87ce2a47 advisory. Update to 2.15.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
Regular Expression Denial Of Service (ReDoS)
GitLab is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is caused due to a lack of input validation within Cargo.toml .An attacker can trigger a Regular Expression Denial of Service ReDoS by using a maliciously crafted input...
OESA-2024-1121 jruby security update
JRuby is a 100% Java implementation of the Ruby programming language. It is Ruby for the JVM. JRuby provides a complete set of core "builtin" classes and syntax for the Ruby language, as well as most of the Ruby Standard Libraries. Security Fixes: A ReDoS issue was discovered in the Time componen...
Regular Expression Denial Of Service (ReDoS)
Axios is vulnerable to Regular Expression Denial of Service ReDoS. This vulnerability is due to the use of a regex with inefficient time complexity when parsing URLS with many / characters within the combineURLs method. This vulnerability results in Denial of Service if an attacker can manipulate...
Regular Expression Denial Of Service (ReDoS)
nodemailer is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to improper parsing of image files when the parameter attachDataUrls is set, resulting in long or infinite parsing time...
nodemailer ReDoS when trying to send a specially crafted email
Summary A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. Details Regex:...
BIT-LIFERAY-2022-42124
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected in...
BIT-LIFERAY-2023-33950
Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs...
PT-2024-40224 · Unknown · Nodemailer
Name of the Vulnerable Software and Affected Versions: nodemailer affected versions not specified Description: A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the event loop to become stuck. Another flaw was found when nodemaile...
RHEL 8 : nodejs:16 (RHSA-2023:1582)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1582 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...
RHEL 8 : nodejs:18 (RHSA-2023:1583)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1583 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 : Jinja2 vulnerabilities (USN-6599-1)
The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6599-1 advisory. Yeting Li discovered that Jinja incorrectly handled certain regex. An attacker could possibly use this issue ...
Gitlab -- vulnerabilities
Gitlab reports: Arbitrary file write while creating workspace ReDoS in Cargo.toml blob viewer Arbitrary API PUT requests via HTML injection in user's name Disclosure of the public email in Tags RSS Feed Non-Member can update MR Assignees of owned MRs...
Regular Expression Denial Of Service (ReDoS)
Embedchain is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the use of a regular expression with inefficient complexity within json.py which allows an attacker to cause Denial of Service DoS...
GHSA-R67W-F99W-MGXJ ReDoS in Embedchain
The JSON loader in Embedchain before 0.1.57 allows a ReDoS regular expression denial of service via a long string to json.py...
ReDoS in Embedchain
The JSON loader in Embedchain before 0.1.57 allows a ReDoS regular expression denial of service via a long string to json.py...
