validate.js 安全漏洞

validate.js is a declarative validation library written in javascript by the individual developer Nicklas Ansman. A security vulnerability exists in validate.js that stems from the presence of a regular expression denial of service vulnerability...

validate.js 安全漏洞

validate.js is a declarative validation library written in javascript by the individual developer Nicklas Ansman. A security vulnerability exists in validate.js version 0.13.1 and prior versions, which stems from the presence of a regular expression denial of service vulnerability...

PT-2024-10794 · Unknown · Foundation

Name of the Vulnerable Software and Affected Versions: Foundation versions 6.3.3 and prior Description: The issue concerns Regular Expression Denial of Service ReDoS due to one or more vulnerable regular expressions in the framework. There is no information available about the estimated number of...

CommonRegexJS 安全漏洞

CommonRegexJS is a CommonRegex port of JavaScript by the individual developer Talysson de Oliveira Cassiano. A security vulnerability exists in CommonRegexJS that stems from the inclusion of one or more regular expressions that are vulnerable to regular expression denial of service ReDoS attacks...

useragent 安全漏洞

useragent is a high-performance user agent parser for Node.js by the individual developer Arnout Kazemier. A security vulnerability exists in useragent that stems from a regular expression denial of service vulnerability...

PT-2024-10795 · Unknown · Commonregexjs

Name of the Vulnerable Software and Affected Versions: CommonRegexJS versions all available versions Description: The issue concerns Regular Expression Denial of Service ReDoS due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in async

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of async. Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of service, caused by the ReDoS Regular Expression Denial of Service while parsing function in autoinject functio...

DEBIAN-CVE-2024-47879

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

UBUNTU-CVE-2024-47879

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

CVE-2024-47879

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

GHSA-3JM4-C6QF-JRH3 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

Summary Lack of CSRF protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains...

Permissive Regular Expression

github.com/facebookincubator/tacquito is vulnerable to Permissive Regular Expression. The vulnerability is due to permissive regex matching where the system matches sub-strings instead of the entire string for authorized commands and arguments. This could allow unauthorized commands to be execute...

Regular Expression Denial Of Service (ReDoS)

Action Mailer is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the blockformat helper taking an unexpected amount of time when processing carefully crafted text, potentially resulting in a DoS condition...

Regular Expression Denial Of Service (ReDoS)

Action Text is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the way the plaintextforblockquotenode helper processes specific text inputs, leading to a scenario where the processing time can grow unexpectedly long, ultimately resulting in a Denial of Servic...

Regular Expression Denial Of Service (ReDoS)

Action Pack is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to inefficient regular expression handling in Action Controller's HTTP Token authentication, which can be triggered by a carefully crafted header, causing significant delays in header parsing...

Regular Expression Denial Of Service (ReDoS)

Action Pack is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the improper handling of regular expressions in the query parameter filtering routines, allowing attackers to craft input that significantly delays processing and potentially leads to a Denial of...

Regular Expression Denial of Service (ReDoS)

Overview @eslint/plugin-kit is an Utilities for building ESLint plugins. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. PoC javascript const argument =...

OpenRefine 代码注入漏洞

OpenRefine is a Java-based open source tool. The product is mainly used for loading data, analyzing data and cleaning data, among other things. A code injection vulnerability exists in OpenRefine prior to version 3.8.3 that stems from the lack of cross-site request forgery protection in the...

PT-2024-32869 · Unknown +3 · Openrefine +3

Name of the Vulnerable Software and Affected Versions: OpenRefine versions prior to 3.8.3 Description: The issue is related to a lack of cross-site request forgery protection on the preview-expression command. This means that visiting a malicious website could cause an attacker-controlled...