9959 matches found
GHSA-JFMF-W293-8XR8 Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 Vaadin versions 8.0.0 through 8.12.4 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses...
Design/Logic Flaw
checksmart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path the /dev/bus substring and a number, aka an unanchored regular expression...
Regular Expression Denial Of Service (ReDoS)
devextreme is vulnerable to regular expression denial of service. The vulnerability exists in validationengine.js because Incorrect sanitations in email validator allows an attacker to use malicious inputs resulting in denial of service conditions...
CVE-2021-42257
checksmart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path the /dev/bus substring and a number, aka an unanchored regular expression...
CVE-2021-42257
The CVE-2021-42257 issue affects check_smart prior to version 6.9.1, where an unprivileged user could gain unintended drive access because the check only matches a substring of a device path (the /dev/bus substring and a number) via an unanchored regular expression. The root cause is a permissive...
DynamicPageList3 Extended Resource Management Error Vulnerability
The DynamicPageList3 extension is a reporting tool for MediaWiki that lists category members and intersections in various formats and details.The DynamicPageList3 extension is vulnerable to a resource management error that stems from an unprocessed regular expression date entered in a parameter o...
Regular Expression Denial Of Service (ReDoS)
mpmath has regular expression denial of service. An attacker is able to crash the system by sending a maliciously crafted string to the convertfallback function...
CVE-2021-41115
Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could...
Design/Logic Flaw
Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could...
CVE-2021-41115
CVE-2021-41115 affects Zulip servers where administrators can configure linkifiers that translate messages into links using arbitrary regular expressions. The underlying issue is a regex-based ReDoS risk: a quadratic-time linkifier can cause denial-of-service if an overly complex or invalid regex...
Security Bulletin: IBM App Connect Enterprise Certified Container images may be vulnerable to Denial of Service attacks due to CVE-2021-23362 and CVE-2021-27290
Summary IBM App Connect Enterprise Certified Container images may be vulnerable to Denial of Service attacks due to regular expression DoS vulnerabilities in the Node module npm. The npm module is not used at runtime by IBM App Connect Enterprise itself, but anyone using the certified containers ...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
CVE-2021-26084 Introduction This write-up provides an over...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
CVE-2021-26084 Introduction This write-up provides an over...
GHSA-V6W3-2PRQ-H95F Improper Input Validation in Jakarta Expression Language
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...
Improper Input Validation in Jakarta Expression Language
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...
CLSA-2021-1633442879 Fix of CVE: CVE-2020-26116, CVE-2020-8492, CVE-2018-20852, CVE-2020-27619
Add Oracle Linux distribution in platform.py - CVE-2018-20852: Prefix dot in domain for proper subdomain validation - CVE-2020-8492: Python allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client - CVE-2020-26116: http.client allows CRLF injection if...
Zulip server 安全漏洞
Zulip server is an open source team chat application from Zulip, Inc. in the United States. Zulip server has a security vulnerability that allows administrators of malicious organizations to subject the server to a denial of service via a regular expression complexity attack...
Expression injection in AviatorScript
AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library BCEL...
GHSA-XPV2-8PPJ-79HH Expression injection in AviatorScript
AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library BCEL...
DynamicPageList 资源管理错误漏洞
The DynamicPageList3 extension is a reporting tool for MediaWiki that lists category members and intersections in various formats and details.The DynamicPageList3 extension is vulnerable to a resource management error that stems from an unprocessed regular expression date entered in a parameter o...