UBUNTU-CVE-2021-35065

The glob-parent package before 6.0.1 for Node.js allows ReDoS regular expression denial of service attacks against the enclosure regular expression...

CVE-2021-35065

The glob-parent package before 6.0.1 for Node.js allows ReDoS regular expression denial of service attacks against the enclosure regular expression...

CVE-2020-26302

CVE-2020-26302 affects the is.js library. Versions ≤ 0.9.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via a URL-validation regex copied from a gist; under malicious input the regex can loop indefinitely. The issue is documented across multiple sources (e.g., GHSA- PVRW-G6FX-MC...

CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...

Regular Expression Denial Of Service (ReDoS)

setuptools is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the REL attribute in the findexternallinks function of packageindex.py, allowing an attacker to crash the application by passing a malicious HTML...

Regular Expression Denial Of Service (ReDoS)

isjs is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for url matching in is.js allowing an attacker to crash the application by providing malicious urls...

Fedora 36 : exim (2022-6125582f45)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6125582f45 advisory. Fixed use after free in regex handler Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Code injection

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...

Fedora 35 : exim (2022-ebb3db782c)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ebb3db782c advisory. Fixed use after free in regex handler Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

CVE-2022-23551

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

Cross site request forgery (csrf)

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

CVE-2022-23551

CVE-2022-23551 concerns AAD Pod Identity: the NMI component could bypass validation for token requests containing a backslash (example /metadata/identity\oauth2\token/), potentially enabling a pod to access identities it should not have. The bug arises from NMI’s regex-based validation and is add...

CVE-2022-23551 AAD Pod Identity obtaining token with backslash

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

CVE-2022-23551 AAD Pod Identity obtaining token with backslash

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

GHSA-P82Q-RXPM-HJPC AAD Pod Identity obtaining token with backslash

Impact What kind of vulnerability is it? Who is impacted? The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request example: /metadata/identity\oauth2\token/ would bypass the NMI validation and be...

PT-2022-7152 · Python Packaging Authority +7 · Wheel +7

Name of the Vulnerable Software and Affected Versions: Python Packaging Authority PyPA Wheel versions 0.37.1 and earlier Description: The issue is related to an uncontrolled resource consumption in the Python Packaging Authority PyPA Wheel, which can be exploited by a remote attacker to cause a...

Improper Restriction of Security Token Assignment

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the call function of the component Regex Handler. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users...

active_attr Improper Resource Shutdown or Release vulnerability

A vulnerability classified as problematic has been found in cgriego activeattr up to 0.15.3. This affects the function call of the file lib/activeattr/typecasting/booleantypecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit ha...

CVE-2021-4250

A vulnerability classified as problematic has been found in cgriego activeattr up to 0.15.2. This affects the function call of the file lib/activeattr/typecasting/booleantypecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit ha...