757 matches found
PYSEC-2022-43178
An exponential ReDoS Regular Expression Denial of Service can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.setrows method...
CVE-2022-42964
An exponential ReDoS Regular Expression Denial of Service can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.fromstring method...
UBUNTU-CVE-2022-42966
An exponential ReDoS Regular Expression Denial of Service can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.setrows method...
CVE-2022-42966 Exponential ReDoS in cleo leads to denial of service
An exponential ReDoS Regular Expression Denial of Service can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.setrows method...
CVE-2022-42966 Exponential ReDoS in cleo leads to denial of service
An exponential ReDoS Regular Expression Denial of Service can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.setrows method...
OESA-2022-2028 nodejs-minimatch security update
Converts glob expressions to JavaScript "RegExp" objects. Security Fixes: A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service ReDoS when calling the braceExpand function with specific arguments, resulting in a Denial of Service.CVE-2022-3517...
Inefficient Regular Expression Complexity in shescape
Impact This impacts users that use shescape to escape arguments: - for the Unix shell Bash, or any not-officially-supported Unix shell; - using the escape or escapeAll functions with the interpolation option set to true. An attacker can cause polynomial backtracking in terms of the input string...
GHSA-8FG9-P83M-X5PQ ReDoS issue in dparse
Impact dparse versions prior to 0.5.1 contain a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. All users parsing index server URLs with dparse are impacted by this vulnerability. Patches The Patch is applied in the 0.5.2 version, all users are recommended to...
CVE-2022-36064
Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells Bash and Dash, or any not-officially-supported Unix shell; and/or using the escape or escapeAll functions with the...
Ruby on Rails: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
I have confirmed that ReDoS occurs on Rails::Html::PermitScrubber.scrubattribute. https://github.com/rails/rails-html-sanitizer/blob/v1.4.3/lib/rails/html/scrubbers.rbL134 ruby def scrubattributenode, attrnode attrname = if attrnode.namespace "attrnode.namespace.prefix:attrnode.nodename" else...
Regular Expression Denial Of Service (ReDoS)
schroot is vulnerable to regualr expression denial of service. The vulnerability exists in isvalidsessionname in sbuild-util.cc because it doesn't limit the allowed characters on schroot names properly which allows an attacker to perform a ReDoS attack...
OESA-2022-1792 python-ldap security update
python-ldap provides an object-oriented API for working with LDAP within Python programs. It allows access to LDAP directory servers by wrapping the OpenLDAP 2.x libraries, and contains modules for other LDAP-related tasks including processing LDIF, LDAPURLs, LDAPv3 schema, etc.. Security Fixes:...
CVE-2022-31147
The jQuery Validation Plugin jquery-validation provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service ReDoS when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix...
UBUNTU-CVE-2022-31147
The jQuery Validation Plugin jquery-validation provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service ReDoS when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix...
nodejs-trim-newlines: ReDoS in .end() method
A flaw was found in nodejs-trim-newlines. Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...
GHSA-WC69-RHJR-HC9G Moment.js vulnerable to Inefficient Regular Expression Complexity
Impact using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has quadratic N^2 complexity on specific inputs noticeable slowdown is observed with inputs above 10k characters users who pass user-provided strings without sanity length checks to moment...
CVE-2021-40892
CVE-2021-40892 affects validate-color version 2.1.0. A Regular Expression Denial of Service (ReDoS) occurs when handling crafted invalid rgb(a) strings, attributed to the validateHTMLColorRgb pathway. Impact described as denial of service; no explicit exploit details beyond input crafting. No con...
PT-2022-11322 · Unknown · Underscore-99Xp
Name of the Vulnerable Software and Affected Versions: underscore-99xp version 1.7.2 Description: A Regular Expression Denial of Service ReDOS issue was found when the deepValueSearch function is called. Recommendations: For underscore-99xp version 1.7.2, consider disabling the deepValueSearch...