CVE-2022-44572

A flaw was found in rubygem-rack. Rack is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in the multipart parsing component. By sending a specially-crafted input, a remote attacker can cause a denial of service...

CVE-2022-44570

A flaw was found in rubygem-rack. Rack is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in the Rack::Utils.getbyteranges function. By sending a specially-crafted regex input, a remote attacker can cause a denial of service...

Regular Expression Denial of Service (ReDoS)

Overview semver is a semantic version parser used by npm. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range. PoC js const semver = require'semver' const lengths2 = 2000, 4000,...

Regular Expression Denial of Service (ReDoS)

Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of an insecure regex \?=\S.+??=\S\. Exploiting this vulnerability will result in catastrophic backtracking...

CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...

CVE-2022-25927

CVE-2022-25927 affects ua-parser-js with a Regular Expression Denial of Service (ReDoS) through the trim() function. Affected versions are: ua-parser-js 0.7.30 and earlier than 0.7.33, and ua-parser-js 0.8.1 and earlier than 1.0.33. The vulnerability arises from the trim() path and could lead to ...

CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...

Regular Expression Denial Of Service(ReDoS)

rack is vulnerable to Regular Expression Denial of ServiceReDoS. The vulnerability exists in the handlemimehead function of multipart.rb due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious input with the Content-Disposition...

Regular Expression Denial Of Service(ReDoS)

actionpack is vulnerable to Regular Expression Denial of ServiceReDoS. The vulnerability exists due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious cookie, in combination with a specially crafted XFORWARDEDHOST header...

Regular Expression Denial Of Service (ReDoS)

cookiejar is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists in the parse function of cookiejar.js due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious string...

Oracle Linux 9 : nodejs / and / nodejs-nodemon (ELSA-2023-0321)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0321 advisory. - Resolves: CVE-2021-44906 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

openSUSE 15 Security Update : python-mechanize (openSUSE-SU-2023:0030-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0030-1 advisory. - mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial...

nodejs-minimatch: ReDoS via the braceExpand function

A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service ReDoS when calling the braceExpand function with specific arguments, resulting in a Denial of Service...

Regular Expression Denial of Service (ReDoS)

Overview ua-parser-js is a lightweight JavaScript-based user-agent string parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the trim function. PoC js const UAParser = require'ua-parser-js'; const count = 200000; //delay starts to be...

ua-parser-js 安全漏洞

ua-parser-js is a JavaScript-based parser for User-Agent strings. It can be used in a browser client-side or node.js server-side environment. Can also be used as a jQuery / Zepto plugin, Bower / Meteor package and RequireJS / AMD module . A security vulnerability exists in ua-parser-js versions...

Regular Expression Denial Of Service (ReDoS)

papapars is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists in papaparse.js due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious string...

rubygem-activesupport 安全漏洞

rubygem-activesupport is an application of rubygems open source. A security vulnerability exists in rubygem-activesupport. An attacker exploited the vulnerability to perform a regular expression denial of service attack...

PT-2023-1551 · Unknown +2 · Html-Stripscripts +2

Name of the Vulnerable Software and Affected Versions: HTML-StripScripts versions 1.06 and earlier Description: The issue is related to the hss attval style function in the HTML-StripScripts module, which allows ReDoS Regular expression Denial of Service due to catastrophic backtracking when...

rubygem-globalid 安全漏洞

rubygem-globalid is an application of rubygems open source. A security vulnerability exists in rubygem-globalid. An attacker exploited the vulnerability to perform a regular expression denial of service attack...

Regular Expression Denial Of Service (ReDoS)

rack is vulnerable to Regular Expression Denial of Service ReDoS attacks. The vulnerability exists in the Range header parsing component of the library, which allows an attacker to significantly slow down the processing via passing a carefully crafted input...