1485 matches found
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Summary Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger...
BucketLoot - An Automated S3-compatible Bucket Inspector
BucketLoot is an automated S3-compatible Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text. The tool can scan for bucke...
Moderate: Red Hat Security Advisory: oniguruma security update
An update for oniguruma is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
Uscrapper - Powerful OSINT Webscraper For Personal Data Collection
Introducing Uscrapper 2.0, A powerfull OSINT webscrapper that allows users to extract various personal information from a website. It leverages web scraping techniques and regular expressions to extract email addresses, social media links, author names, geolocations, phone numbers, and usernames...
Oracle Linux 8 : container-tools:4.0 (ELSA-2024-0121)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0121 advisory. - rebuild for CVE-2023-29406 - rebuild with golang 1.20.6+ for CVE-2023-39321 CVE-2023-29409 - rebuild for following CVEs: CVE-2022-41724 - rebuild...
AlmaLinux 8 : container-tools:4.0 (ALSA-2024:0121)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0121 advisory. golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseabl...
golang: regexp/syntax: limit memory used by parsing regexps
A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as...
The vulnerability of the Django web application framework, related to insufficient processing of regular expressions, allows a hacker to trigger a service failure.
The vulnerability of the Django web application framework is related to insufficient processing of regular expressions. Exploiting this vulnerability can allow a malicious actor to cause service failures...
SUSE CVE-2023-47038
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...
USN-6517-1: Perl vulnerabilities
It was discovered that Perl incorrectly handled printing certain warning messages. An attacker could possibly use this issue to cause Perl to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2022-48522 Nathan Mills discovered that Perl incorrectly...
CVE-2022-40896
A denial-of-service vulnerability related to regular expressions was discovered in Pygments, specifically in the file pygments/lexers/smithy.py. An attacker could exploit this flaw by sending a carefully crafted request, leading to a denial-of-service situation. Mitigation Mitigation for this iss...
PT-2023-7202
Name of the Vulnerable Software and Affected Versions perl versions 5.30.0 through 5.38.0 Description The issue is related to a buffer overflow in dynamic memory due to improper handling of crafted regular expressions. This can allow a remote attacker to control the buffer overflow, potentially...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
CVE-2023-49146
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
Design/Logic Flaw
DOMSanitizer aka dom-sanitizer before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions...
DOMSanitizer Security Vulnerability
DOMSanitizer is a DOM Document Object Model security operation or filter by Andy Miller, a personal developer. A security vulnerability exists in versions of DOMSanitizer prior to 1.0.7 that stems from mishandling of annotations and greedy regular expressions, allowing cross-site scripting XSS...
