GHSA-V638-Q856-GRG8 MathJax Regular expression Denial of Service (ReDoS)

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk...

CVE-2023-39663

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk...

UBUNTU-CVE-2023-39663

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk...

Input validation

DISPUTED Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk...

Malicious code in @cybs-ui/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e25c2aa7aae39d30717302a7e0a6b94336a286f1167456157770d53c08d9ba99 The OpenSSF Package Analysis project identified '@cybs-ui/components' @ 7.0.0 npm as malicious. It is considered malicious because: - The packag...

CVE-2023-39663

CVE-2023-39663 affects MathJax up to v2.7.9. The issue is two Regular Expression Denial of Service (ReDoS) flaws in MathJax.js triggered via the components pattern and markdownPattern. The vendor disputes the risk on the basis that the regexes aren’t applied to user input. Documented impact from ...

PT-2023-27062 · Mathjax · Mathjax

Name of the Vulnerable Software and Affected Versions: Mathjax versions up to v2.7.9 Description: The issue concerns two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. However, the vendor disputes this, stating that the...

A remote attacker can supply specially crafted transfer-encoding chunks to Eclipse Jetty that may bypass the authorization checks of an intermediary caching proxy.

In Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration with RFC2616 compliance enabled, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a...

Malware in @dpdgroupuk/design-space-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1546 Malicious code in marionette-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4962667c8dd0da2bbc76d598b0820a7371844141b721e7d346913fae8581c733 The OpenSSF Package Analysis project identified 'marionette-ui-components' @ 6.9.2 npm as malicious. It is considered malicious because: - The...

Malicious code in marionette-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4962667c8dd0da2bbc76d598b0820a7371844141b721e7d346913fae8581c733 The OpenSSF Package Analysis project identified 'marionette-ui-components' @ 6.9.2 npm as malicious. It is considered malicious because: - The...

Malicious code in lp-vue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e0fc5aaed8de1640179a965d23507da2a63fc462c9349da8ed2eae78398c577 The OpenSSF Package Analysis project identified 'lp-vue-components' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1543 Malicious code in lp-vue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e0fc5aaed8de1640179a965d23507da2a63fc462c9349da8ed2eae78398c577 The OpenSSF Package Analysis project identified 'lp-vue-components' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

federation components and the Data Compromise

The vulnerability of the federation components and the RabbitMQ messaging broker components is related to the improper implementation of user input processing. Exploiting this vulnerability allows an attacker to compromise data integrity...

MAL-2023-1499 Malicious code in jscrambler-dashboard-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a31aff9b73f313c920ebbb6370e3afc3139565f139114ab47ef7859e989f418 The OpenSSF Package Analysis project identified 'jscrambler-dashboard-components' @ 9.9.9 npm as malicious. It is considered malicious because: ...

Part III: Implementing Effective Cyber Security Metrics that Reduce Risk Realistically

We outlined some critical cybersecurity metrics in Part I of this three-part blog series. In the final blog post, we will delve into three crucial aspects outlined in Josh’s article: tactical metrics for operational teams, strategic metrics for leadership, and the metrics addressing the...

GHSA-WRW3-QMQW-4X9W wger Workout Manager Cross-Site Request Forgery vulnerability

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

PYSEC-2023-144

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-36306

A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components...

PT-2023-25521 · Adiscon · Loganalyzer

Name of the Vulnerable Software and Affected Versions: Adiscon LogAnalyzer versions through 4.1.13 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via the "asktheoracle.php", "details.php", "index.php", "search.php", "export.php", "reports.php", an...