EulerOS 2.0 SP9 : python-configobj (EulerOS-SA-2024-1493)

According to the versions of the python-configobj package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate function, using...

GHSA-5PGG-2G8V-P4X9 SheetJS Regular Expression Denial of Service (ReDoS)

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service ReDoS. A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com...

SheetJS Regular Expression Denial of Service (ReDoS)

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service ReDoS. A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com...

PT-2024-19365 · Unknown · Sheetjs Community Edition

Name of the Vulnerable Software and Affected Versions: SheetJS Community Edition versions prior to 0.20.2 Description: The issue is related to a Regular Expression Denial of Service ReDoS in the SheetJS Community Edition. It is estimated that over 2,000,000 devices are potentially affected due to...

CVE-2024-22363

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service ReDoS...

Security Bulletin: Multiple vulnerabilities in IBM Business Automation Workflow Machine Learning Server are addressed with 23.0.2-IF002

Summary In addition to updates to operating system level packages, IBM Business Automation Workflow Machine Learning Server 23.0.2-IF002 addresses the following vulnerabilities. Vulnerability Details CVEID:CVE-2024-24762 DESCRIPTION: FastAPI is vulnerable to a denial of service, caused by a regul...

ruby: ReDoS vulnerability in URI

A flaw was found in the rubygem URI. The URI parser mishandles invalid URLs that have specific characters, which causes an increase in execution time parsing strings to URI objects. This may result in a regular expression denial of service ReDoS...

Regular Expression Denial Of Service (ReDoS)

angular is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression backtracking in the ng-srcset directive. This potentially leads to Regular Expression Denial of Service ReDoS...

Lucee Remote Code Execution Vulnerability

The Lucee Server Lucee is a dynamic, java-based markup and scripting language used for rapid web application development. Lucee suffers from a remote code execution vulnerability that can be exploited to execute system commands by accepting the name of a cookie as one of its parameters and passin...

SUSE CVE-2023-46046

An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via tiexpr in a crafted .mzn file. NOTE: this is disputed because there is no common libminizinc use case in which an unattended process is supposed to run forever to process a series of atttacker-controlled .mzn files...

MiniZinc 安全漏洞

MiniZinc is a high-level constraint modeling language for easily expressing and solving discrete optimization problems. A security vulnerability exists in MiniZinc prior to version 2.8.0, which stems from allowing NULL pointer dereferencing via tiexpr in specially crafted .mzn files...

PT-2024-20898 · Unknown · Domain-Suffix

Name of the Vulnerable Software and Affected Versions: domain-suffix version 1.0.8 Description: The issue allows attackers to crash the application via crafted input to the parse function, resulting in a Denial of Service. This is achieved through a RegEx Denial of Service in the domain-suffix...

CVE-2024-29833

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target ...

CVE-2024-29833 WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target ...

Expression Language Injection

OpenMetadata is vulnerable to Expression Language Injection. The vulnerability is due to in validateExpression function evaluates SpEL expressions using a StandardEvaluationContext, This enabling interaction with Java classes like java.lang.Runtime, ultimately resulting in Remote Code Execution...

Expression Language Injection

OpenMetadata is vulnerable to Expression Language Injection. The vulnerability is caused due to a lack of proper authorization checks, allowing attackers to execute arbitrary code by exploiting Expression language injection in the CompiledRule::validateExpression method...

openSUSE Security Advisory (openSUSE-SU-2024:0080-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-40676 · Unknown · Javaparser

Name of the Vulnerable Software and Affected Versions: JavaParser affected versions not specified Description: A security exception occurs due to an issue in the TreeVisitorValidator.accept and FieldAccessExpr.getMetaModel functions. Recommendations: At the moment, there is no information about a...

Security Bulletin: Vulnerability in Spring Data MongoDB might affect IBM Storage Copy Data Management. [CVE-2022-22980]

Summary IBM Storage Copy Data Management can be affected by a vulnerability in Spring Data MongoDB. A remote attacker could exploit this vulnerability to execute arbitrary code on the system as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-2298...

[SECURITY] [DLA 3768-1] pillow security update

Debian LTS Advisory DLA-3768-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton March 22, 2024 https://wiki.debian.org/LTS Package : pillow Version : 5.4.1-2+deb10u5 CVE ID : CVE-2021-23437 CVE-2022-22817 CVE-2023-44271 Multiple vulnerabilities were discovered in the...