4774 matches found
oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
An out-of-bounds read vulnerability was found in Oniguruma in the way it handled regular expression quantifiers. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, could possibly crash the application,...
Ruby on Rails: HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.
When a site is configured to use the .tkte.ch leading dot short form for domain name, ex: ruby config.hosts You are being redirected. Where the controller is simply: ruby class RedirectController ApplicationController def main redirectto action: 'main' end end The host header poisoning was report...
serenity:FuzzRegexPosixExtended: Heap-buffer-overflow in regex::Lexer::back
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5077400093982720 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzRegexPosixExtended Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...
Atlassian Fisheye Crucible Denial of Service Vulnerability
Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A denial of service vulnerability exists in Atlassian Fisheye/Crucible, which can be exploited by an...
CVE-2020-14190
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4...
CVE-2020-14190
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4...
Code injection
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4...
CVE-2020-14190
CVE-2020-14190 affects Atlassian Fisheye/Crucible where a user-supplied regex in EyeQL can cause a Regex Denial of Service. Affected versions are before 4.8.4. Fixed in 4.8.4 and also in 4.9.0. The issue is triggered by an attacker-supplied regex in EyeQL that leads to DoS; no exploitation detail...
CVE-2020-14190
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4...
CVE-2020-28360
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
CVE-2020-28360
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
Code injection
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
CVE-2020-28360
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
CVE-2020-28360
CVE-2020-28360 describes an SSRF vulnerability in the npm package private-ip (versions 1.0.5 and earlier). The root cause is an insufficient RegEx filter for reserved IP ranges, allowing an attacker to craft requests to ARIN/other reserved ranges, which can lead to remote server-side resource req...
Scratch Addons Cross-Site Scripting Vulnerability
Scratch Addons is a plugin from the Scratch Addons community for providing theme changing functionality for browsers. The addon supports Chrome and Firefox browsers. A cross-site scripting vulnerability exists in Scratch Addons, which stems from the use of incorrect regular expressions, which can...
fabric8-analytics-lsp-server (0.3.0), graphql-validated-types (>=2.7.0, <=2.11.0) +1 more potentially affected by unknown CVE via semver-regex (>=3.0.0, <=3.1.1)
semver-regex NPM version =3.0.0, =2.7.0, =1.2.0, =1.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-SEMVERREGEX-1047770...
A user-supplied regex in EyeQL causes ReDoS - CVE-2020-14190
Affected version of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4. Affected versions: version 4.8.4 Fixed versions: 4.8.4 4.9.0...
A user-supplied regex in EyeQL causes ReDoS - CVE-2020-14190
Affected version of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4. Affected versions: version 4.8.4 Fixed versions: 4.8.4 4.9.0...
A user-supplied regex in EyeQL causes ReDoS - CVE-2020-14190
Affected version of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4. Affected versions: version 4.8.4 Fixed versions: 4.8.4 4.9.0...
CVE-2020-13349
CVE-2020-13349 affects GitLab EE; a regular expression used for file-path handling in Advanced Search causes catastrophic backtracking in multiple version ranges. Affected: GitLab EE 8.12 and newer with specific gaps: >=8.12, =13.4, =13.5,