OSV-2020-1820 Stack-buffer-overflow in hermes::regex::Parser<hermes::regex::Regex<hermes::regex::UTF16RegexTraits>, cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25815 Crash type: Stack-buffer-overflow READ 2 Crash state: hermes::regex::Parser, cha hermes::regex::Parser, cha hermes::regex::Parser, cha...

hermes:fuzzer-jsi-entry: Stack-buffer-overflow in hermes::regex::Parser<hermes::regex::Regex<hermes::regex::UTF16RegexTraits>, cha

Project: https://github.com/facebook/hermes.git Detailed Report: https://oss-fuzz.com/testcase?key=5645974943563776 Project: hermes Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-jsi-entry Job Type: libfuzzerasanhermes Platform Id: linux Crash Type: Stack-buffer-overflow READ 2 Crash Address:...

Ubuntu: Security Advisory (USN-4502-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

USN-4502-1 ruby-websocket-extensions vulnerability

It was discovered that websocket-extensions does not properly parse special headers. A remote attacker could use this issue to cause regex backtracking, resulting in a denial of service. CVE-2020-7663...

USN-4502-1: websocket-extensions vulnerability

It was discovered that websocket-extensions does not properly parse special headers. A remote attacker could use this issue to cause regex backtracking, resulting in a denial of service. CVE-2020-7663...

ModSecurity 3.0.x Denial Of Service Vulnerability

ModSecurity version 3.0.x suffers from a denial of service vulnerability due to the handling of regular expression matching. ModSecurity version 3.0.x is affected by a denial of service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular...

personnummer/php vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c

An out-of-bounds read vulnerability was found in Oniguruma in the way it handled regular expression quantifiers. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, could possibly crash the application,...

oniguruma: NULL pointer dereference in match_at() in regexec.c

A NULL Pointer Dereference in matchat in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust...

oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c

A vulnerability was found in Oniguruma, where improper bounds checking in strlowercasematch within regexec.c can cause a heap-based buffer overflow, a remote attacker could exploit this flaw to crash the application or, in certain scenarios, execute arbitrary code. This occurs when the applicatio...

oniguruma: Use-after-free in onig_new_deluxe() in regext.c

A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...

Denial Of Service (DoS)

personnummer is vulnerable to denial of service. A validation bypass vulnerability in the regex parsing causes slow response from the server...

PT-2023-11819 · Mholt · Papaparse

Name of the Vulnerable Software and Affected Versions: mholt PapaParse versions up to 5.1.x Description: A vulnerability was found in the file papaparse.js, leading to inefficient regular expression complexity. The issue is classified as problematic and affects an unknown function. Upgrading to...

CVE-2019-5645

By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on th...

In the GNU C Library (aka glibc or libc6) through 2.29 proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

...

USN-4460-1 libonig vulnerabilities

It was discovered that Oniguruma incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified impact. CVE-2019-16163, CVE-2019-19012, CVE-2019-19204, CVE-2019-19246...

Regular Expression Denial of Service

Overview All versions of url-regex are vulnerable to a Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. Recommendation There are no patches and the software is not currently maintained. The security researcher who found t...

Nautilus - A Grammar Based Feedback Fuzzer

Nautilus is a coverage guided, grammar based fuzzer. You can use it to improve your test coverage and find more bugs. By specifying the grammar of semi valid inputs, Nautilus is able to perform complex mutation and to uncover more interesting test cases. Many of the ideas behind this fuzzer are...

Regex DoS via JQL version searching - CVE-2020-14177

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service DoS vulnerability in JQL version searching. Affected versions: version 7.13.16 8.0.0 ≤ version 8.5.7 8.6.0 ≤ version 8.10.2 8.11.0 ≤ versi...