PT-2018-3769

Name of the Vulnerable Software and Affected Versions Tenda AC7 versions through V15.03.06.44 CNAC7 Tenda AC9 versions through V15.03.05.196318 CNAC9 Tenda AC10 versions through V15.03.06.23 CNAC10 Description A command injection issue allows attackers to execute arbitrary OS commands via a craft...

GHSA-WRVR-8MPX-R7PP mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input

Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. Recommendation Update to version 2.0.3 or later...

Command Injection in dns-sync

Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve method. Recommendation - Use an alternative dns resolver - Do not allow untrusted input into dns-sync.resolve...

CVE-2016-9483

CVE-2016-9483 involves PHP FormMail Generator-generated PHP form code where phpfmg_filman_download() deserializes untrusted input, enabling a remote, unauthenticated attacker to inject PHP code. The description notes that, combined with CVE-2016-9484, this can lead to local file inclusion attacks...

dns-sync Command Injection Vulnerability

dns-sync is a library used in Node.js that allows to resolve hostnames in a synchronized way. A security vulnerability exists in dns-sync. An attacker can exploit this vulnerability to inject commands with untrusted user input...

timespan module denial of service vulnerability

The timespan module is a JavaScript-based implementation of TimeSpans. A security vulnerability exists in the timespan module. An attacker can exploit this vulnerability to cause a denial of service with untrusted user input...

string module denial of service vulnerability

The string module is a lightweight JavaScript library that provides additional String methods for Node.js. A security vulnerability exists in the string module. An attacker can exploit this vulnerability to cause a denial of service with the help of untrustworthy specially crafted input...

mime module denial of service vulnerability

mime module is a MIME type module. A security vulnerability exists in the mime module. An attacker can exploit this vulnerability to cause a denial of service with untrusted user input...

parsejson module denial of service vulnerability

The parsejson module is a module for parsing JSON. A security vulnerability exists in the parsejson module. An attacker can exploit this vulnerability to cause a denial of service with untrusted user input...

slug denial of service vulnerability

slug is a module capable of blocking strings. A security vulnerability exists in slug. An attacker could exploit this vulnerability to cause a denial of service with untrustworthy specially crafted input...

Debug Module Denial of Service Vulnerability

debug module is a module for debugging JavaScript utilities in Node.js. A security vulnerability exists in the debug module. An attacker can exploit this vulnerability to cause a denial of service with untrusted user input...

Security Bulletin: IBM QRadar SIEM and Incident Forensics relies on an untrusted input. (CVE-2016-2881)

Summary The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. Vulnerability Details CVE-ID: CVE-2016-2881 Description: IBM QRadar and Incident Forensics...

Siaberry 1.2.2 - Command Injection

Siaberry 1.2.2 - Command Injection Siaberry's Command Injection Vulnerability Today, I’d like to share several interesting vulnerabilities I discovered in Siaberry, a hardware device for earning cryptocurrency. Siaberry runs on Sia, a decentralized marketplace for buying and selling data storage...

CVE-2017-16138

The mime module is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input...

AZL-44400 CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

AZL-43792 CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

DEBIAN-CVE-2017-16138

The mime module 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input...

DEBIAN-CVE-2017-16137

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

AZL-43819 CVE-2017-16137 affecting package nodejs-nodemon 2.0.3-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

AZL-44772 CVE-2017-16137 affecting package nodejs-nodemon 2.0.3-5

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...