Apprise vulnerable to regex injection with IFTTT Plugin

Impact Anyone publicly hosting the Apprise library and granting them access to the IFTTT notification service. Patches Update to Apprise v0.9.5.1 bash Install Apprise v0.9.5.1 from PyPI pip install apprise==0.9.5.1 The patch to the problem was performed here. Workarounds Alternatively, if upgradi...

CVE-2021-33580 regex injection leading to DoS

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

@adv-ui/nc-strings (3.2.0), @arshad/gatsby-theme-phoenix (>=1.1.0, <=1.1.8) +154 more potentially affected by CVE-2021-32696 via striptags (>=3.0.0, <=3.1.1)

striptags NPM version =3.0.0, =1.1.0, =1.0.0, =0.1.0, =0.3.0, =1.1.1-alpha.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.3.3, =1.0.2, =1.0.6 and more Source cves: CVE-2021-32696 Source advisory: OSV:GHSA-QXG5-2QFF-P49R...

GitHub Security Lab: [Java]: CWE-730 Regex injection

This bug was reported directly to GitHub Security Lab...

Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Impact The regex injection that may lead to Denial of Service. Patches Will be patched in 2.4 and 3.0 Workarounds Versions lower than 2.x are only affected if the navigation module is added References See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 If you...

GHSA-HF44-3MX6-VHHW Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Impact The regex injection that may lead to Denial of Service. Patches Will be patched in 2.4 and 3.0 Workarounds Versions lower than 2.x are only affected if the navigation module is added References See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 If you...

CVE-2021-29506 Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix:...

CVE-2021-29506

GraphHopper CVE-2021-29506 affects GrassHopper 2.0–2.4. The vulnerability is a regular expression injection that may cause Denial of Service. Root cause is in the navigation/regex handling in GrassHopper prior to 2.4. This has been patched in GraphHopper 2.4 and 3.0. Connected advisories and Red ...

Ruby on Rails: Regex Injection from request header (Rack::Sendfile, send_file)

I have confirmed that Rack::Sendfile and the Rails sendfile that handles it have a problem handling custom headers for request. It is expected that the X-Sendfile-type and X-Accel-Mapping headers will be sent from nginx, but these headers can also be sent from a user agent such as a browser. This...

CVE-2020-5251

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way...

GitHub Security Lab: CodeQL query for finding ReDoS and Regex Injection vulnerabilities in Java

This bug was reported directly to GitHub Security Lab...

@augmt/request-header-parser-microservice (0.2.4), @sealcode/crud-ui (>=0.0.1-beta1, <=0.0.18) +80 more potentially affected by CVE-2017-16030 via useragent (>=2.0.0, <=2.1.9)

useragent NPM version =2.0.0, =0.0.1-beta1, =0.1.3, =0.17.29, =1.0.4, =0.1.7, =0.0.1, =3.0.3, =0.1.6, =0.1.2, =1.2.0, =0.0.1, =0.4.4, =0.5.4 and more Source cves: CVE-2017-16030 Source advisory: OSV:GHSA-PJMX-9XR3-82QR...

FreeBSD : radicale -- multiple vulnerabilities (ff824eea-c69c-11e5-96d6-14dae9d210b8)

Radicale reports : The multifilesystem backend allows access to arbitrary files on all platforms. Prevent regex injection in rights management. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databas...

Debian DLA-403-1 : radicale security update

Several issues have been discovered by Unrud in Radicale, a calendar and addressbook server. A remote attacker could exploit these vulnerabilities and call arbitrary functions by sending crafted HTTP requests. CVE-2015-8748 Prevent regex injection in rights management. Prevent crafted HTTP reques...