9971 matches found
RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
A security-sensitive bug was discovered by Open Source Developer Erik Sundell of Sundell Open Source Consulting AB. The functions RandomAlphaNumericint and CryptoRandomAlphaNumericint are not as random as they should be. Small values of int in the functions above will return a smaller subset of...
PT-2021-4068 · Unknown +4 · Normalize-Url +4
Name of the Vulnerable Software and Affected Versions: normalize-url versions 4.5.0 and earlier, 5.x before 5.3.1, and 6.x before 6.0.1 Description: The issue is related to a ReDoS regular expression denial of service problem, which causes exponential performance for data: URLs. This can lead to...
Oracle Linux 6 : perl (ELSA-2021-9238)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9238 advisory. - Backport patch for CVE-2020-10543 Orabug: 32855589 - Backport patch for CVE-2020-10878 Orabug: 32855589 Tenable has extracted the preceding descripti...
CVE-2021-31158
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access...
CVE-2021-31158
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access...
Design/Logic Flaw
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access...
CVE-2021-31158
The CVE affects Couchbase Server 6.5.x and 6.6.x up to 6.6.1, where the Query Engine’s Common Table Expressions did not correctly enforce per-user permissions, allowing read access to resources beyond what a user is explicitly allowed. This impacts confidentiality (High) without integrity/availab...
Couchbase Server 安全漏洞
Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, which stems from a...
Moderate: Red Hat Security Advisory: perl security and bug fix update
An update for perl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS
Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkindOPn == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection...
Moderate: perl security and bug fix update
Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl: heap-based buffer overflow in regular expression compiler leads to DoS CVE-2020-10543 perl: corruption of intermediate language state of compiled regular...
Regular Expression Denial Of Service (ReDoS)
graphhopper-nav is vulnerable to Regular Expression Denial Of Service ReDoS. An attacker is able to crash the application by submitting a malicious url string via the getPointsFromRequest function...
CVE-2021-32816
ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular expression denial-of-service vulnerability. This was fixed in commit 6687fb. There is a full report available in the referenced...
Code injection
ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular expression denial-of-service vulnerability. This was fixed in commit 6687fb. There is a full report available in the referenced...
AngularJS ProtonMail Web Client 资源管理错误漏洞
AngularJS is an open source web application framework based on TypeScript.ProtonMail Web Client is an AngularJS web client. AngularJS ProtonMail Web Client is vulnerable to a resource management error vulnerability that stems from the presence of a regular expression denial of service vulnerabili...
Regular Expression Denial of Service
Overview In websocket-extensions before version 0.1.4, there is a vulnerability which allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form: Sec-WebSocket-Extensions: a;...
Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS in...
Security Bulletin: A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial o...
CVE-2021-29506
GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix:...
