UBUNTU-CVE-2022-23517

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23517 Inefficient Regular Expression Complexity in rails-html-sanitizer

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23517

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

DEBIAN-CVE-2022-23514

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23514

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23514

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23514 Inefficient Regular Expression Complexity in Loofah

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

CVE-2022-23514

An inefficient regular expression vulnerability was found in rubygem loofah. While sanitizing certain SVG attributes, loofah is susceptible to excessive backtracking, which can result in a denial of service through CPU resource consumption...

Regular Expression Denial Of Service (ReDoS)

loofah is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the attrnode.value attribute in the scrubattributes function of scrub.rb, allowing an attacker to crash the application by providing malicious SVG attributes...

Rails 安全漏洞

Rails is a set of open source web application frameworks based on the Ruby language from the American Rails team. A security vulnerability exists in Rails rails-html-sanitizer versions prior to 1.4.4, which stems from the use of inefficient regular expressions that are susceptible to excessive...

X.Org X Server 资源管理错误漏洞

X.Org X Server is an X Window System display server from the X.org Foundation. X.Org X Server suffers from a resource management error vulnerability that stems from the fact that the handler of its ScreenSaverSetAttributes request may write to memory after releasing the request potentially...

UBUNTU-CVE-2022-46343

A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution f...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS which leads to excessive backtracking when attempting to sanitize certain SVG attributes. This can lead to CPU resource consumption. Details Denial of Service DoS describes a family of attacks,...

PT-2022-36580 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.334 Description: The issue is related to an overflow when iterating ATTR RECORDs in ntfs. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior...

Prototype Pollution

nodebb is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the Namespaces attribute in the index.js and modify attributes such as proto, constructor, and prototype...

UBUNTU-CVE-2022-45283

GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smilparsetimelist parameter at /scenegraph/svgattributes.c...

Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow

...

[SECURITY] Fedora 37 Update: drupal7-link-1.11-1.fc37

The link module can be count to the top 50 modules in Drupal installations and provides a standard custom content field for links. With this module links can be added easily to any content types and profiles and include advanced validating and different ways of storing internal or external links...

Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the following shortcode in a page/post...

HTTP response splitting in CGI

If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body. Also, the contents for a CGI::Cookie object were not checked properly. If an application creates a CGI::Cookie object bas...