3678 matches found
CVE-2018-13863
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
CVE-2018-13863
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
Design/Logic Flaw
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
Security Bulletin: Two ReDoS vulnerabilities in modules included in the Node.js npm tool
Summary Two ReDoS vulnerabilities in modules included in the Node.js npm tool shipped by IBM Rational Application Developer for WebSphere Software. Vulnerability Details CVEID: CVE-2016-2515 DESCRIPTION: Node.JS hawk is vulnerable to a denial of service, caused by an error in the regular expressi...
Regular Expression Denial Of Service (ReDoS)
no-case is vulnerable to regular expression denial of service ReDoS attacks. The library does not properly sanitize user input strings, causing slowdown when matching strings that can lead to a ReDoS...
Regular Expression Denial Of Service (ReDoS)
charset is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string to the through the HTTP header to cause a ReDoS attack...
Regular Expression Denial Of Service (ReDoS)
ua-parser is vulnerable to regular expression denial of service ReDoS. A malicious user can pass a string through the User-Agent header to cause a ReDoS...
Regular Expression Denial Of Service (ReDoS)
method-override is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability exists when parsing malicious X-HTTP-Method-Override header...
spring-framework: ReDoS Attack with spring-messaging
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...
CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
CVE-2018-3738
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...
CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
CVE-2018-3738
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...
DEBIAN-CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
CVE-2017-16086
ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...
Default credentials
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...
Design/Logic Flaw
ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...
Code injection
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...
