CVE-2022-1954

A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers...

UBUNTU-CVE-2022-1954

A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers...

CVE-2022-1954

CVE-2022-1954 affects GitLab CE/EE. The vulnerability is a Regular Expression Denial of Service in processing web server response headers, potentially causing a GitLab instance to become inaccessible. Affected versions: GitLab before 14.10.5 (i.e., 1.0.2 to

kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check leads to a use-after-free (write)

REJECTED CVE A use-after-free vulnerability has been identified in the Linux Kernel's netfilter subsystem that did not properly handle the removal of stateful expressions in some situations. A local attacker could use this to cause a denial of service system crash or execute arbitrary code...

kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check leads to a use-after-free (write)

REJECTED CVE A use-after-free vulnerability has been identified in the Linux Kernel's netfilter subsystem that did not properly handle the removal of stateful expressions in some situations. A local attacker could use this to cause a denial of service system crash or execute arbitrary code...

kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check leads to a use-after-free (write)

REJECTED CVE A use-after-free vulnerability has been identified in the Linux Kernel's netfilter subsystem that did not properly handle the removal of stateful expressions in some situations. A local attacker could use this to cause a denial of service system crash or execute arbitrary code...

that-value Regular Expression Denial of Service (ReDOS) Vulnerability

that-value is a multilingual platform validator package by the individual developer Paweł Stefański, Poland. A Regular Expression Denial of Service ReDOS vulnerability exists in that-value version v0.1.3, which can be exploited by an attacker to cause a denial of service when validating a crafted...

PT-2022-17493 · Unknown · Scss-Tokenizer

Name of the Vulnerable Software and Affected Versions: scss-tokenizer versions prior to 0.4.3 Description: The issue is related to a Regular Expression Denial of Service ReDoS in the scss-tokenizer package. This occurs via the loadAnnotation function due to the usage of insecure regex...

PT-2022-14214 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.10.4 GitLab CE/EE versions 15.0 through 15.0.3 GitLab CE/EE versions 15.1 through 15.1.0 Description: A Regular Expression Denial of Service issue allows an attacker to make a GitLab instance inaccessibl...

PT-2022-7237 · Unknown · Jquery-Validation

Name of the Vulnerable Software and Affected Versions: jquery-validation versions prior to 1.19.5 Description: The issue is related to the incorrect handling of regular expressions in the url2 method of the jQuery Validation Plugin, which can lead to a denial of service when an attacker supplies...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions...

golang: regexp: stack exhaustion via a deeply nested expression

A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...

GHSA-4CF5-XMHP-3XJ7 Improper Authorization in Apache Shiro

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 - conFLU PoC for exploiting CVE-2022-26134 on...

Inefficient Regular Expression Complexity potentially leads to Denial of Service in

Description Inefficient regular expression complexity of lowercase and uppercase regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeati + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase. The same issue happens with...

GSD-2022-1004093 netfilter: nf_tables: disallow non-stateful expression in sets earlier

netfilter: nftables: disallow non-stateful expression in sets earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.318 by commit...

GSD-2022-1004024 netfilter: nf_tables: disallow non-stateful expression in sets earlier

netfilter: nftables: disallow non-stateful expression in sets earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.283 by commit...

GSD-2022-1003928 netfilter: nf_tables: disallow non-stateful expression in sets earlier

netfilter: nftables: disallow non-stateful expression in sets earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.247 by commit...

GSD-2022-1003814 netfilter: nf_tables: disallow non-stateful expression in sets earlier

netfilter: nftables: disallow non-stateful expression in sets earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003661 netfilter: nf_tables: disallow non-stateful expression in sets earlier

netfilter: nftables: disallow non-stateful expression in sets earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.120 by commit...