EulerOS Virtualization 3.0.2.2 : python-jinja2 (EulerOS-SA-2023-1285)

According to the versions of the python-jinja2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre...

EulerOS Virtualization 3.0.2.2 : python (EulerOS-SA-2023-1284)

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client...

CVE-2023-23621 Discourse vulnerable to ReDoS in user agent parsing

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and version 3.1.0.beta2 on the beta and tests-passed branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0....

CVE-2023-23621 Discourse vulnerable to ReDoS in user agent parsing

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and version 3.1.0.beta2 on the beta and tests-passed branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0....

CVE-2022-25927

A flaw was found in ua-parser-js. This issue could allow a malicious user to trigger a regular expression denial of service ReDoS via the trim function...

Discourse 3.1.x < 3.1.0.beta2 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-py (SUSE-SU-2023:0161-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0161-1 advisory. - CVE-2022-42969: Fixed an excessive resource consumption that could be triggered when interacting with a...

Design/Logic Flaw

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...

CVE-2023-22795

A flaw was found in the rubygem-actionpack. RubyGem's actionpack gem is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in Action Dispatch related to the If-None-Match header. By sending a specially-crafted HTTP If-None-Match header, a remote attacker...

Important: Red Hat Security Advisory: Migration Toolkit for Runtimes security update

An update is now available for Migration Toolkit for Runtimes v1.0.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2022-44570

A flaw was found in rubygem-rack. Rack is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in the Rack::Utils.getbyteranges function. By sending a specially-crafted regex input, a remote attacker can cause a denial of service...

CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...

CVE-2022-25927

CVE-2022-25927 affects ua-parser-js with a Regular Expression Denial of Service (ReDoS) through the trim() function. Affected versions are: ua-parser-js 0.7.30 and earlier than 0.7.33, and ua-parser-js 0.8.1 and earlier than 1.0.33. The vulnerability arises from the trim() path and could lead to ...

CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...

CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...

Regular Expression Denial Of Service (ReDoS)

ua-parser-js is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists due to an insecure Regex pattern used for the str attribute in the trim function of ua-parser.js, which allows an attacker to crash the application by providing a maliciously crafted string...

Regular Expression Denial Of Service (ReDoS)

rack is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists in getfilename function of parser.rb due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious input with a RFC2183-multipart-boundary stri...

Regular Expression Denial Of Service(ReDoS)

rack is vulnerable to Regular Expression Denial of ServiceReDoS. The vulnerability exists in the handlemimehead function of multipart.rb due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious input with the Content-Disposition...

Regular Expression Denial Of Service(ReDoS)

actionpack is vulnerable to Regular Expression Denial of ServiceReDoS. The vulnerability exists due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious cookie, in combination with a specially crafted XFORWARDEDHOST header...

Regular Expression Denial Of Service (ReDoS)

actionpack is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists in the ifnonematchetags function of cache.rb due to inefficient regular expression complexity which allows an attacker to crash the application. The vulnerability only applies to ruby 3.2.0...