6742 matches found
Cross site scripting
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...
GHSA-582F-P4PG-XC74 Regular Expression Denial of Service in csv-parse
Versions of csv-parse prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the cast option...
Regular Expression Denial of Service in csv-parse
Versions of csv-parse prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the cast option...
@magento/upward-spec (>=2.0.0-rc.19, <=3.0.0), @nowtilus/nemo-lib (>=0.3.0, <=0.3.3) +18 more potentially affected by CVE-2019-17592 via csv-parse (>=4.0.0, <=4.4.5)
csv-parse NPM version =4.0.0, =2.0.0-rc.19, =0.3.0, =5.4.0, =0.3.0, =3.3.1, =5.4.0-RC1, =1.0.35, =0.6.2, =2.1.0-beta.2939, =4.2.3, =0.0.1, =0.1.4, =0.44.1, =0.48.7 and more Source cves: CVE-2019-17592 Source advisory: OSV:GHSA-582F-P4PG-XC74...
CVE-2019-17592
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option...
CVE-2019-17592
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option...
Design/Logic Flaw
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option...
CVE-2019-17592
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option...
CVE-2019-17592
CVE-2019-17592 affects Node.js csv-parse prior to 4.4.6, where a malformed regular expression in the __isInt() function under the cast option enables a Denial of Service with crafted input. The vulnerability is tied to the csv-parse module, with CVSS v3.1 base score 7.5 (high) and CVSS v2 base sc...
CVE-2019-17592
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option...
PT-2019-15217
Name of the Vulnerable Software and Affected Versions csv-parse versions prior to 4.4.6 Description The issue concerns a Regular Expression Denial of Service in the isInt function, which contains a malformed regular expression. This function processes large crafted input very slowly when the cast...
CVE-2019-17592: Uncontrolled Resource Consumption
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The isInt function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option...
Export Users to CSV < 1.4 - Unauthorised CSV Access
The plugin exports a CSV file containing sensitive user data. The generated files are stored in a public directory with a predictable filename based on a Unix timestamp. CSV files are discoverable either through enumeration or path traversal. Export Users to CSV does not provide visibility over...
Fedora Update for phpMyAdmin FEDORA-2019-3b5a7abe17
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 29 Update: phpMyAdmin-4.9.1-1.fc29
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...
Privilege escalation
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...
CVE-2019-11275 CSV Injection in usage report downloaded from Pivotal Application Manager
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...
CVE-2019-11275
CVE-2019-11275 affects Pivotal Application Manager (versions 666.0.x before 666.0.36, 667.0.x before 667.0.22, 668.0.x before 668.0.21, 669.0.x before 669.0.13, and 670.0.x before 670.0.7). A remote authenticated user can create an app with a name that a CSV program may interpret as a formula, le...
CVE-2019-11275: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...
