3366 matches found
CVE-2022-25887
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...
Ruby on Rails: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
I have confirmed that ReDoS occurs on Rails::Html::PermitScrubber.scrubattribute. https://github.com/rails/rails-html-sanitizer/blob/v1.4.3/lib/rails/html/scrubbers.rbL134 ruby def scrubattributenode, attrnode attrname = if attrnode.namespace "attrnode.namespace.prefix:attrnode.nodename" else...
CVE-2022-36034
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of and with many repetitions of |. This issue has been patched in all versions above 0.2.5. There are currently no known workarounds...
CVE-2022-36034 Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.js
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of and with many repetitions of |. This issue has been patched in all versions above 0.2.5. There are currently no known workarounds...
CVE-2022-36034
CVE-2022-36034 concerns nitrado.js, a type-safe wrapper for the Nitrado API. The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by polynomial/complex regex handling on uncontrolled input (notably patterns like {{ and repeated {{|). Impact, per multiple sources, is High (CV...
Regular Expression Denial Of Service (ReDoS)
uri-template-lite is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the expandRe attribute in index.js, allowing an attacker to crash the application by providing a malicious input through the URI.expand method...
uri-template-lite Regular Expression Denial of Service
An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...
GHSA-CHW2-6C7R-37P7 uri-template-lite Regular Expression Denial of Service
An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...
CVE-2021-43309
An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...
Design/Logic Flaw
An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...
CVE-2021-43309 ReDoS in uri-template-lite URI.expand function
An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...
uri-template-lite 安全漏洞
uri-template-lite is a LiteJS open source URI template RFC 6570 expansion and extraction. uri-template-lite has a security vulnerability that can trigger an exponential ReDoS in the uri-template-lite package when an attacker is able to provide arbitrary input to the URI.expand method...
Regular Expression Denial Of Service (ReDoS)
eth-account is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the TYPEREGEX attribute in the validatetypesattribute function of validation.py, allowing an attacker to crash the application by providing a malicious input...
CVE-2022-1930
CVE-2022-1930 – ReDoS in eth-account encode_structured_data Affected software: eth-account Python package. Vulnerable component: encode_structured_data function, with root cause linked to the insecure regex pattern used for TYPE_REGEX in validation.py, enabling exponential Regular Expression Deni...
PT-2022-4437
Name of the Vulnerable Software and Affected Versions eth-account affected versions not specified Description The issue is related to an exponential ReDoS Regular Expression Denial of Service that can be triggered in the eth-account PyPI package. This occurs when an attacker is able to supply...
eth_account 安全漏洞
ethaccount is an ethereum account generator. A security vulnerability exists in versions of ethaccount prior to 0.5.9, which can be exploited by an attacker to trigger an exponential ReDoS in the eth-account PyPI package when providing arbitrary input to the encodestructureddata method...
Regular Expression Denial Of Service (ReDoS)
schroot is vulnerable to regualr expression denial of service. The vulnerability exists in isvalidsessionname in sbuild-util.cc because it doesn't limit the allowed characters on schroot names properly which allows an attacker to perform a ReDoS attack...
AlmaLinux 8 : ruby:2.5 (5779) (ALSA-2022:5779)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5779 advisory. ruby: Regular expression denial of service vulnerability of Date parsing methods CVE-2021-41817 ruby: Cookie prefix spoofing in CGI::Cookie.parse...
Oracle Linux 8 : ruby:2.5 (ELSA-2022-5779)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5779 advisory. - Fix by adding length limit option for methods that parses date strings. Resolves: CVE-2021-41817 Tenable has extracted the preceding description bloc...
