rubygem-rack: parsing Content-Disposition header DoS

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service infinite loop via a crafted Content-Disposion header...

DEBIAN-CVE-2013-0242

Buffer overflow in the extendbuffers function in the regular expression matcher posix/regexec.c in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service memory corruption and crash via crafted multibyte characters...

CVE-2013-0242

Buffer overflow in the extendbuffers function in the regular expression matcher posix/regexec.c in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service memory corruption and crash via crafted multibyte characters...

CVE-2013-0242

CVE-2013-0242 affects the GNU C Library (glibc) in the extend_buffers() path of the regular expression matcher (regexec.c). A buffer overflow via crafted multibyte input can cause memory corruption and denial of service. Affected line items indicate it exists in glibc ≤ 2.17; multiple advisories ...

Immunity Canvas: ADOBE_FLASH_REGEXP

Name| adobeflashregexp ---|--- CVE| CVE-2013-0634 Exploit Pack| CANVAS Description| adobeflashregex Notes| CVE Name: CVE-2013-0634 VENDOR: Adobe Notes: This module exploit's a heap based buffer overflow on Adobe Flash Player while handling a regex object. It bypasses ASLR leaking a vtable pointer...

tcl security and bug fix update

8.4.13-6 - Fixed infinite loop in regex NFA optimization code Resolves: CVE-2007-4772 - Fixed ON^2 compile time and huge memory requirements for some regexps Resolves: CVE-2007-6067 8.4.13-5 - Threaded / nonthreaded versions of tcl are now switchable through alternatives Resolves: rhbz478961...

phpwcms 'preg_replace()'多个远程PHP代码注入漏洞

BUGTRAQ ID: 56964 phpwcms是开源内容管理系统。 phpwcms 1.5.4.6及其他版本在实现上存在多个代码注入漏洞，通过身份验证的远程攻击者可以用"backend user""admin user""backend user"账户利用这些漏洞（"frontend user"账户不能利用这些漏洞）在受影响计算机内执行任意PHP脚本代码。 0 phpwcms = v1.5.4.6 厂商补丁： phpwcms ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpwcms.de/...

Cross site scripting

The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted string...

CVE-2010-1330

JRuby prior to 1.4.1 contains an XSS vulnerability in its regex engine when $KCODE is set to 'u'. The flaw occurs because the engine does not properly handle characters immediately after a UTF-8 character, enabling remote attackers to inject crafted strings and execute script in vulnerable contex...

Invision Power Board 3.3.4 Unserialize REGEX Bypass

?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring $serialized && strpos $serialized, "\0" === false if strpos $serialized...

Invision Power Board (IP.Board) 3.3.4 - Unserialize Regex Bypass

Invision Power Board IP.Board 3.3.4 - Unserialize Regex Bypass ?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring...

Invision Power Board (IP.Board) 3.3.4 - Unserialize Regex Bypass

?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring $serialized && strpos $serialized, "\0" === false if strpos $serialized...

EasyITSP - 'customers_edit.php' Authentication Bypass

source: https://www.securityfocus.com/bid/56321/info EasyITSP is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to customer's information. EasyITSP 2.0.2 is vulnerable; other versions may also be...

EasyITSP - customers_edit.php Authentication Bypass

EasyITSP - customersedit.php Authentication Bypass source: https://www.securityfocus.com/bid/56321/info EasyITSP is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to customer's information. EasyITSP...

Google Chrome Multiple Vulnerabilities-01 (Oct 2012) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome Multiple Vulnerabilities-01 Oct12 (Windows)

This host is installed with Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvuln01oct12win.nasl 5963 2017-04-18 09:02:14Z teissa $ Google Chrome Multiple Vulnerabilities-01 Oct12 Windows Authors: Antu Sanadi Copyright: Copyright c 2012...

Google Chrome Multiple Vulnerabilities-01 Oct12 (Mac OS X)

This host is installed with Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvuln01oct12macosx.nasl 5963 2017-04-18 09:02:14Z teissa $ Google Chrome Multiple Vulnerabilities-01 Oct12 Mac OS X Authors: Antu Sanadi Copyright: Copyright c 2012...

FreeBSD : chromium -- multiple vulnerabilities (e6161b65-1187-11e2-afe3-00262d5ed8ee)

Google Chrome Releases reports : 138208 High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG. 147499 Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG. 148692 Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthu...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 138208 High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG. 147499 Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG. 148692 Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur...

Scientific Linux Security Update : perl on SL4.x, SL3.x i386/x86_64

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. CVE-2007-5116 %NASLMINLEVEL 70300 C Tenable Network...