UBUNTU-CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...

CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...

CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...

CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...

CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...

CVE-2021-28170

The CVE-2021-28170 issue affects Eclipse EE4J Jakarta Expression Language. A flaw in the ELParserTokenManager enables invalid EL expressions to be evaluated as valid, effectively bypassing input validation. This impacts Jakarta EL up to version 3.0.3 and earlier. The associated IBM/NVD entries de...

Regular Expression Denial of Service (ReDoS)

Overview trim-off-newlines is a Similar to Stringtrim but removes only newlines Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via string processing. PoC const trim = require'trim-off-newlines'; for let i=10; i 25; i += 1 const s = 'a' + "rn".repeat...

Regular Expression Denial of Service (ReDoS)

Overview ansi-html is an An elegant lib that converts the chalked ANSI text to HTML. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time. PoC...

python-httplib2: Regular expression denial of service via malicious header

An uncontrolled resource consumption flaw as found in python-httplib2, due to a flawed regular expression used while parsing the WWW-Authenticate header in an HTTP response. This flaw allows a malicious or compromised server to reply with a crafted sequence of characters in the WWW-Authenticate...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (python-httplib2) security update

An update for python-httplib2 is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network...

Oracle Linux 8 : perl (ELSA-2021-1678)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1678 advisory. - Fix CVE-2020-10543 bug 1839273 - Fix CVE-2020-10878 bug 1839276 Tenable has extracted the preceding description block directly from the Oracle Linux...

Jakarta Expression Language 输入验证错误漏洞

Jakarta Expression Language is a language of the Jakarta project. It provides an important mechanism to enable the representation layer web pages to communicate with application logic managed beans. A security vulnerability exists in Jakarta Expression Language implementation version 3.0.3 and...

Regular Expression Denial of Service

Overview The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service ReDoS during parsing of queries. Recommendation Upgrade to version 4.16.5 or later References - CVE - GitHub Advisory...

GHSA-W8QV-6JWH-64R5 Regular Expression Denial of Service in browserslist

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service ReDoS during parsing of queries...

CVE-2021-33502

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data: URLs...

Regular Expression Denial of Service (ReDoS)

Overview forms is a libary that allows you to create, parse, and validate forms Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via email validation. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessib...

Security update for python-httplib2 (moderate)

openSUSE Security Update: Security update for python-httplib2 Announcement ID: openSUSE-SU-2021:0772-1 Rating: moderate References: 1171998 1182053 Cross-References: CVE-2020-11078 CVE-2021-21240 CVSS scores: CVE-2020-11078 NVD : 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CVE-2020-11078 SUS...

RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

Impact A security-sensitive bug was discovered by Open Source Developer Erik Sundell of Sundell Open Source Consulting AB. The functions RandomAlphaNumericint and CryptoRandomAlphaNumericint are not as random as they should be. Small values of int in the functions above will return a smaller subs...

GHSA-XG2H-WX96-XGXR RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be

Impact A security-sensitive bug was discovered by Open Source Developer Erik Sundell of Sundell Open Source Consulting AB. The functions RandomAlphaNumericint and CryptoRandomAlphaNumericint are not as random as they should be. Small values of int in the functions above will return a smaller subs...