spring-expression: Denial of service when processing a specially crafted Spring Expression Language expression

A flaw was found in the Spring framework package. A maliciously crafted Spring Expression Language SePL may trigger uncontrolled CPU usage, leading to a denial of service in the application consuming it. To be considered vulnerable, one application has to evaluate user-supplied SpEL expressions...

Eval Injection

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Eval Injection via the result = evals field of the iscallableexpression function in the agentscope\web\workstation\workflowutils.py file. An attacker can execute...

GHSA-6P55-QR3J-MPGQ AgentScope uses `eval`

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

Mastodon 4.2.x < 4.2.13 Regular Expression Denial of Service

According to its self-reported version number, the version of Mastodon running on the remote host is prior to 4.1.20 or 4.2.x prior to 4.2.12. Therefore, it may be affected by a regular expression denial of service vulnerability. Note that the scanner has not tested for these issues but has inste...

Mastodon < 4.1.20 Regular Expression Denial of Service

According to its self-reported version number, the version of Mastodon running on the remote host is prior to 4.1.20 or 4.2.x prior to 4.2.12. Therefore, it may be affected by a regular expression denial of service vulnerability. Note that the scanner has not tested for these issues but has inste...

PYSEC-2024-262

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

PT-2024-32970 · Unknown · Agentscope

Name of the Vulnerable Software and Affected Versions: agentscope versions 0.0.0 through 0.0.4 Description: The issue is related to the function is callable expression in the file agentscopewebworkstationworkflow utils.py. This function contains the line result = evals, which poses a security ris...

SUSE CVE-2020-26311

Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no patches are available...

JetBrains YouTrack Denial of Service Vulnerability

JetBrains YouTrack is a project management tool, developed by JetBrains, supporting cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. A denial of service vulnerability...

CVE-2024-48572

A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...

The vulnerability of the http.cookies library in the Python programming language allows a hacker to trigger a service failure.

The vulnerability of the http.cookies library in the Python interpreter relates to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service interruptions...

ROS-20241029-08

Vulnerability in the OpenSearch software package related to improper validation of the nextUrl parameter. Exploitation of the vulnerability could allow an attacker to redirect a user to a malicious site A vulnerability in the server.maxHeadersCount configuration of the ws client-server library in...

PT-2024-9013

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Red Hat products affected versions not specified Description: A vulnerability was found in Keycloak, allowing a user with high privileges to read sensitive information from a Vault file that is not...

CVE-2024-48572

A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against emai...

GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito

Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...

CVE-2020-26311

A flaw was found in Useragent package, a user agent parser for Node.js. Affected versions of this package contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2020-26303

A flaw was found in the insane package, a whitelist-oriented HTML sanitizer. Affected versions of this package contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. Mitigation Mitigation for this issue is either not available or the currently...

Huawei EulerOS: Security Advisory for python-configobj (EulerOS-SA-2024-2656)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python-configobj (EulerOS-SA-2024-2622)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool, developed by JetBrains, supporting cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. A denial of service vulnerability...