CVE-2023-5876 Regex DoS from a malicious server enrolled in Desktop

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...

CVE-2023-0632

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry...

Gitlab -- Vulnerabilities

Gitlab reports: ReDoS via ProjectReferenceFilter in any Markdown fields ReDoS via AutolinkFilter in any Markdown fields Regex DoS in Harbor Registry search Arbitrary read of files owned by the "git" user via malicious tar.gz file upload using GitLab export functionality Stored XSS in Web IDE Beta...

CVE-2023-2199

GitLab CE/EE (versions 12.0–15.10.7, 15.11.0–15.11.6, 16.0.0–16.0.1) are affected by CVE-2023-2199 due to a Regular Expression Denial of Service in the preview_markdown endpoint. The underlying issue is a regex-based processing path that can be triggered by crafted payloads, potentially impacting...

AZL-10892 CVE-2022-40023 affecting package python-mako for versions less than 1.2.2-1

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin...

CVE-2022-40023

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin...

CVE-2022-40023

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin...

CVE-2022-2075

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation...

Apache Tika contains incomplete fix for regex DoS

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

Design/Logic Flaw

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

CVE-2022-33879

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

CVE-2022-33879 Incomplete fix and new regex DoS in StandardsExtractingContentHandler

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

CVE-2022-33879

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

CVE-2022-33879 Incomplete fix and new regex DoS in StandardsExtractingContentHandler

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1...

AlmaLinux 8 : python-pillow (ALSA-2021:4149)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:4149 advisory. - In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer...

Inefficient Regular Expression Complexity in tapjs/tap-mocha-reporter

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in tap-mocha-reporter. The ReDoS vulnerability is mainly due to the regex /^\s+|\s+$|/g and can be exploited with the following code. Proof of Concept // PoC.js var tapMochaReporter =...

Security update for python-markdown2 (moderate)

openSUSE Security Update: Security update for python-markdown2 Announcement ID: openSUSE-SU-2021:0451-1 Rating: moderate References: 1171379 1181270 1183171 Cross-References: CVE-2021-26813 CVSS scores: CVE-2021-26813 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products:...

OPENSUSE-SU-2021:0451-1 Security update for python-markdown2

This update for python-markdown2 fixes the following issues: Update to 2.4.0 boo1181270: - pull 377 Fixed bug breaking strings elements in metadata lists - pull 380 When rendering fenced code blocks, also add the language-LANG class - pull 387 Regex DoS fixes CVE-2021-26813, boo1183171 - Switch o...

openSUSE Security Update : python-markdown2 (openSUSE-2021-429)

This update for python-markdown2 fixes the following issues : Update to 2.4.0 boo1181270 : - pull 377 Fixed bug breaking strings elements in metadata lists - pull 380 When rendering fenced code blocks, also add the language-LANG class - pull 387 Regex DoS fixes CVE-2021-26813, boo1183171 - Switch...

Security update for python-markdown2 (moderate)

openSUSE Security Update: Security update for python-markdown2 Announcement ID: openSUSE-SU-2021:0429-1 Rating: moderate References: 1171379 1181270 1183171 Cross-References: CVE-2021-26813 CVSS scores: CVE-2021-26813 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products:...