PT-2022-14915 · Url-Regex · Url-Regex

Name of the Vulnerable Software and Affected Versions: url-regex versions all Description: The issue is related to Regular Expression Denial of Service ReDoS, which can cause CPU usage to crash. Recommendations: For url-regex version all, consider disabling the use of the url-regex package until ...

OWASP ESAPI 安全漏洞

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. cross-site scripting vulnerabilities exist in versions of OWASP ESAPI prior to 2.3.0.0, which originate from the " onsiteURL" regular expression erro...

Regular Expression Denial of Service

Overview All versions of url-regex are vulnerable to a Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. Recommendation There are no patches and the software is not currently maintained. The security researcher who found t...

Regular expression denial of service in url-regex

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

Denial of service

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

CVE-2020-7661

CVE-2020-7661 affects the url-regex package (and related urlregex) with a Regular Expression Denial of Service caused by catastrophic backtracking when testing very long strings in String.test. Affected: url-regex/url-regex-based packages (Node.js/npm ecosystem) with versions prior to the fix. Im...

Regular Expression Denial of Service (ReDoS)

Overview url-regex is a package with regular expression for matching URLs Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. An attacker providing a very long string in String.test can cause a Denial of Service. PoC by Nick Baugh For url-regex package:...

08cms (1.0.0), 0card-images-helper (1.0.2) +5064 more potentially affected by CVE-2020-7661 via url-regex (>=1.0.4, <=5.0.0)

url-regex NPM version =1.0.4, =1.0.3, =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.1 - 3e 1.0.0 and more Source cves: CVE-2020-7661 Source advisory: SNYK:JS-URLREGEX-569472...

Regular Expression Denial of Service (ReDoS)

Overview urlregex is a no-dependency URL validation for Node and the browser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. An attacker providing a very long string in String.test can cause a Denial of Service. PoC by Nick Baugh For url-regex...

CVE-2019-12524

An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is...

Internet Bug Bounty: Cache Manager ACL Bypass

Summary: ACL Manager can be bypassed giving non authorized users to squid-internal-mgr. Possible to bypass other urlregex, but only focused on manager. with the hostname of the server running squid echo -e "GET https://jeriko.one%252f@:3128/squid-internal-mgr/activerequests HTTP/1.1\r\n\r\n" |nc...

CVE-2017-8794

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...

GLSA-200403-11 : Squid ACL [url_regex] bypass vulnerability

The remote host is affected by the vulnerability described in GLSA-200403-11 Squid ACL urlregex bypass vulnerability A bug in Squid allows users to bypass certain access controls by passing a URL containing '%00' which exploits the Squid decoding function. This may insert a NUL character into...

DEBIAN-CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...