Input validation

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2023-25826 Remote Code Execution in OpenTSDB

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2023-25826

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2022-23551

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

CVE-2022-23551 AAD Pod Identity obtaining token with backslash

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

CVE-2022-23551 AAD Pod Identity obtaining token with backslash

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

Improper Restriction of Security Token Assignment

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

CKEditor Dialog Plugin DoS

The vulnerability of the dialog plugin in the WYSIWYG editor CKEditor is related to an uncontrolled resource consumption during the processing of regular expressions for validation purposes. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2021-31405

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 Vaadin 14.0.6 through 14.4.3, and 3.0.0 through 4.0.2 Vaadin 15.0.0 through 17.0.10 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses...

PT-2021-19286

Name of the Vulnerable Software and Affected Versions com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 com.vaadin:vaadin-text-field-flow versions 3.0.0 through 4.0.2 Description The issue is related to an unsafe validation RegEx in the EmailField component, which allows attackers to...

CVE-2020-7754: Undefined Security Weakness

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters...

UBUNTU-CVE-2019-10640

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption...

CVE-2019-10640

Removed by vendor...

GitLab CE and EE Uncontrolled Resource Consumption Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An uncontrolled resource consumption vulnerability exists in GitLab CE and EE. The vulnerability...

CVE-2018-19990

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pi...

bson is vulnerable to denial of service due to incorrect regex validation

BSON injection vulnerability in the legal function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...

GHSA-H6RJ-8R3C-9GPJ bson is vulnerable to denial of service due to incorrect regex validation

BSON injection vulnerability in the legal function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...