4365 matches found
CVE-2021-3807
ansi-regex is vulnerable to Inefficient Regular Expression Complexity...
Regular Expression Denial Of Service (ReDoS)
semver-regex is vulnerable to regular expression denial of service. An attacker is able to crash the application by submitting a malicious string to the function semverRegex...
OSV-2021-1266 UNKNOWN WRITE in void AK::BumpAllocator<true, 2097152ul>::for_each_chunk<AK::UniformBumpAllocator
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38701 Crash type: UNKNOWN WRITE Crash state: void AK::BumpAllocator::foreachchunk::BumpAllocatedLinkedList regex::Matcher::execute...
CVE-2021-3795
semver-regex is vulnerable to Inefficient Regular Expression Complexity...
CVE-2021-3795
semver-regex is vulnerable to Inefficient Regular Expression Complexity...
Design/Logic Flaw
semver-regex is vulnerable to Inefficient Regular Expression Complexity...
CVE-2021-3795
CVE-2021-3795 affects the semver-regex package with Inefficient Regular Expression Complexity, leading to potential DoS. Affected: Carbon project packages (see Affected Products list). Remediation: upgrade to the fixed Carbon release set (e.g., prettier-config-carbon 0.12.0, @carbon/cli 11.31.0, ...
CVE-2021-3795 Inefficient Regular Expression Complexity in sindresorhus/semver-regex
semver-regex is vulnerable to Inefficient Regular Expression Complexity...
CVE-2021-3794
vuelidate is vulnerable to Inefficient Regular Expression Complexity...
CVE-2021-3794
CVE-2021-3794 affects the vuelidate/vuelidate package family. A Regular Expression Denial of Service (ReDoS) vulnerability exists in the url(input) validation path, where crafted input can cause excessive CPU usage, leading to potential availability impact. This is documented across multiple sour...
Inefficient Regular Expression Complexity in clean-css/clean-css
✍️ Description It allows cause a denial of service when calling function isDataUriResource. 🕵️♂️ Proof of Concept // PoC.js var isDataUriResource = require"clean-css/lib/utils/is-data-uri-resource" forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = 'data:' +...
WWWGrep - OWASP Foundation Web Respository
WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed. Header names and values may also be recursively searched in this manner. WWWGrep was...
Inefficient Regular Expression Complexity in sindresorhus/semver-regex
✍️ Description It allows cause a denial of service when formatting crafted invalid semver versions. 🕵️♂️ Proof of Concept // PoC.mjs import semverRegex from 'semver-regex'; forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = '0.0.0-0' + '.-------'.repeati1 + '@';...
Regular Expression Denial Of Service(ReDoS)
flaskrestx is vulnerable to regular expression denial of service. The use of emailregex allows an attacker to send malicious string to cause excessive processing of regex engine...
Improper Access Control in agentejo/cockpit
✍️ Description A local file inclusion vulnerability allows attackers to bypass the need for API Keys when querying private custom API endpoints 🕵️♂️ Proof of Concept 1. On the server create a custom API endpoint in /var/www/html/config/api/custom.php as follows: param'test'; if !$test return...
Regular Expression Denial of Service in flask-restx
Flask RESTX contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service in emailregex...
Regular Expression Denial Of Service (ReDoS)
pillow is vulnerable to regular expression denial of service. The getrgb function accepts user-provided very long color specifier, exhausting regex engine due to excessive CPU consumption and resulting in a Denial of Service...
DEBIAN-CVE-2021-23437
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function...
