14358 matches found
CVE-2017-16137
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...
CVE-2017-16116
The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...
CVE-2017-16113
The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed...
CVE-2017-16138
The mime module 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input...
Cisco Integrated Management Controller Supervisor and Cisco UCS Director DOM Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director Software could allow an authenticated, remote attacker to conduct a Document Object Model-based DOM-based, stored cross-site scripting XSS attack against a us...
Cross-site Scripting (XSS)
groovy-postbuild is vulnerable to cross-site scripting XSS attacks. The library does not escape user input for badge content, allowing a malicious user to inject and execute arbitrary Javascript...
CVE-2018-6662
Privilege Escalation vulnerability in McAfee Management of Native Encryption MNE before 4.1.4 allows local users to gain elevated privileges via a crafted user input...
Privilege escalation
Privilege Escalation vulnerability in McAfee Management of Native Encryption MNE before 4.1.4 allows local users to gain elevated privileges via a crafted user input...
CVE-2017-16021
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...
Design/Logic Flaw
i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next =1.10.2...
CVE-2017-16008
i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next =1.10.2...
OLX: Reflective XSS at olx.ph
Hello, I would like to report a reflective XSS at https://www.olx.ph. Steps to reproduce Visit the following link: https://www.olx.ph/all-results?q=car&utmsource=OptHomepageVar0&utmmedium=Search&utmcampaign=toto%27-alertdocument.domain-%27-%27 An XSS should pop-up F305078 Technical Details The...
Liberapay: Missing back-end user input validation can lead to DOS flaw
Hello Team, Usually such kind of reports are out of scope, however I still would like to report you the business logic weakness that should be eliminated, at least from my point of view. Due to missing user input validation it is can lead to application unavailability. Details: During brief revie...
DEBIAN-CVE-2016-10537
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the ModelEscape function of backbone 0.3.3 and earlier, if a user is...
CVE-2016-10548
Arbitrary code execution is possible in reduce-css-calc node module =1.2.4 through crafted css. This makes cross sites scripting XSS possible on the client and arbitrary code injection possible on the server and user input is passed to the calc function...
CVE-2016-10520
jadedown is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in...
CVE-2016-10520
jadedown is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in...
CVE-2016-10521
jshamcrest is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in to the emailAddress validator...