CVE-2020-7753

CVE-2020-7753: The Connected IBM bulletin confirms that the trim package is vulnerable to Regular Expression Denial of Service (ReDoS) via trim() in all versions. It assigns a high base score (7.5) and references IBM X-Force data; however, the bulletin does not publicly specify a patched version ...

CVE-2020-7753 Regular Expression Denial of Service (ReDoS)

All versions of package trim are vulnerable to Regular Expression Denial of Service ReDoS via trim...

PT-2020-6965

Name of the Vulnerable Software and Affected Versions trim versions prior to 0.0.3 trim affected versions not specified, but all versions are mentioned as vulnerable in some sources Description The issue is related to the trim function in the trim package, which is vulnerable to Regular Expressio...

Scientific Linux Security Update : python3 on SL7.x x86_64 (20201001)

Security Fixes : - python: XSS vulnerability in the documentation XML-RPC server in servertitle field CVE-2019-16935 - python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS CVE-2020-8492 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

python3 security update

CentOS Errata and Security Advisory CESA-2020:3888 An update for python3 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Regular Expression Denial Of Service (ReDoS)

npm-user-validate is vulnerable to regular expression denial of service ReDoS. The vulnerability exists as an email string that starts with the @ character causes an exponentially longer time to process the entire input string...

Regular Expression Denial of Service in npm-user-validate

npm-user-validate before version 1.0.1 is vulnerable to a Regular Expression Denial of Service REDos. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. Impact The issue affects the email function. If you use this function to...

Denial of Service in locutusjs/locutus

Description locutus is vulnerable to ReDoS. The regular expression at src/php/network/inetpton.js:24 is vulnerable to ReDoS. It is possible to cause increasing slow-downs which lock the event loop by passing strings which have some number of repeating a characters followed by a . character. For...

Regular Expression Denial Of Service (ReDoS)

dat.gui is vulnerable to regular expression denial of service. The sub-pattern \s.+\s in interpret.js and can be exploited to cause a denial of service...

CS Money: ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)

Summary: The endpoint /graphql has a vulnerable query operation named "search", that can I send a Regex malformed parameter, in order to trick the original regular expression to a regex bomb expression. + Payload with a "common" search, querying the value "AAA": query a searchq: "AAA", lang: "en"...

Oracle Linux 7 : python3 (ELSA-2020-3888)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3888 advisory. - Security fix for CVE-2020-8492 Resolves: rhbz1810616 - Security fix for CVE-2019-16935 Resolves: rhbz1797999 Tenable has extracted the preceding...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

Design/Logic Flaw

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

CVE-2019-20922 affects the Handlebars.js template engine before 4.4.5. The vulnerability stems from an eager RegExp matching approach in the parser, which can be forced into an endless loop by crafted templates, leading to resource exhaustion. Impact is described as denial of service via consumed...

RHEL 7 : python3 (RHSA-2020:3888)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3888 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Regular Expression Denial of Service (ReDoS)

Overview Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. The ReDoS vulnerability ...

FreeBSD : Python -- multiple vulnerabilities (2cb21232-fb32-11ea-a929-a4bf014bf5f7)

Python reports : bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest.... bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and...