4366 matches found
Arkhota - A Web Brute Forcer For Android
What? Arkhota is a web HTTP/S brute forcer for Android. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather than a laptop/computer. For this situations...
perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive Sstudychunk calls...
Caronte - A Tool To Analyze The Network Flow During Attack/Defence Capture The Flag Competitions
Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using protocol...
React Native代码问题漏洞
React Native is an open source JavaScript framework. It is used to build user interfaces and native applications. A code issue vulnerability exists in react-native version 0.59.0, which stems from a regular expression in the validateBaseUrl function that could cause an application to use too many...
Prototype Pollution in robinvdvleuten/shvl
✍️ Description Hi, I've seen a recent prototype pollution report to this library and, during the code review, found out that the applied fix doesn't work at all. The problem relies in the regex used to fix, as I shown bellow. 🕵️♂️ Proof of Concept The reported prototype pollution resulted in the...
Regular Expression Denial Of Service (ReDoS)
normalize-url is vulnerable to regular expression denial of service. The usage of an insecure regex allows an attacker to cause a denial of service condition via a malicious URL string...
Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
Impact The regex injection that may lead to Denial of Service. Patches Will be patched in 2.4 and 3.0 Workarounds Versions lower than 2.x are only affected if the navigation module is added References See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 If you...
GHSA-HF44-3MX6-VHHW Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
Impact The regex injection that may lead to Denial of Service. Patches Will be patched in 2.4 and 3.0 Workarounds Versions lower than 2.x are only affected if the navigation module is added References See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 If you...
IPED - Digital Forensic Tool - Process And Analyze Digital Evidence, Often Seized At Crime Scenes By Law Enforcement Or In A Corporate Investigation By Private Examiners
IPED is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners. Introduction IPED - Digital Evidence Processor and Indexer translated from Portuguese is a tool implement...
glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read
In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match...
perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS
Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkindOPn == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection...
perl: heap-based buffer overflow in regular expression compiler leads to DoS
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow...
openSUSE Security Update : monitoring-plugins-smart (openSUSE-2021-706)
This update for monitoring-plugins-smart fixes the following issues : monitoring-plugins-smart was updated to 6.9.1 : This is a security-release boo1183057 + Fixes the regular expression for pseudo-devices under the /dev/bus/N path. from 6.9.0 + Allows using PCI device paths as device names 64 +...
CVE-2021-32816
ProtonMail Web Client (AngularJS) before v3.16.60 is affected by a regular expression denial-of-service vulnerability. The issue stems from the regex handling in the Web Client and can be triggered client-side, leading to resource exhaustion. It has been fixed in commit 6687fb. A full report is a...
USN-4954-1: GNU C Library vulnerabilities
Jason Royes and Samuel Dytrych discovered that the memcpy implementation for 32 bit ARM processors in the GNU C Library contained an integer underflow vulnerability. An attacker could possibly use this to cause a denial of service application crash or execute arbitrary code. CVE-2020-6096 It was...
USN-4954-1 glibc vulnerabilities
Jason Royes and Samuel Dytrych discovered that the memcpy implementation for 32 bit ARM processors in the GNU C Library contained an integer underflow vulnerability. An attacker could possibly use this to cause a denial of service application crash or execute arbitrary code. CVE-2020-6096 It was...
CVE-2021-29506 Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix:...
CVE-2021-29506
GraphHopper CVE-2021-29506 affects GrassHopper 2.0–2.4. The vulnerability is a regular expression injection that may cause Denial of Service. Root cause is in the navigation/regex handling in GrassHopper prior to 2.4. This has been patched in GraphHopper 2.4 and 3.0. Connected advisories and Red ...
openSUSE: Security Advisory for monitoring-plugins-smart (openSUSE-SU-2021:0706-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...