9761 matches found
CVE-2018-25079
The CVE-2018-25079 entry concerns Segmentio is-url up to version 1.2.2. The issue is in an unknown function within index.js that causes inefficient regular expression complexity (redos). Impact is remote exploitation with potential denial of service risk (high availability impact) as per the CVSS...
CVE-2018-25079 Segmentio is-url index.js redos
A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version...
CVE-2023-23925
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. This issue has been...
CVE-2023-23925 Switcher Client contains Regular Expression Denial of Service (ReDoS)
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. This issue has been...
CVE-2023-23925 Switcher Client contains Regular Expression Denial of Service (ReDoS)
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. This issue has been...
switcher-client-master 安全漏洞
switcher-client-master is a Switcher API open source JavaScript SDK for using the Switcher API. A security vulnerability exists in switcher-client-master prior to version 3.1.4, which stems from not filtering input information before it is used to construct a regular expression...
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Impact Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. Patches Patched in 3.1.4 Workarounds Avoid using Strategy settings that use REGEX in conjunction with EXIST a...
GHSA-WQXW-8H5G-HQ56 Switcher Client contains Regular Expression Denial of Service (ReDoS)
Impact Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. Patches Patched in 3.1.4 Workarounds Avoid using Strategy settings that use REGEX in conjunction with EXIST a...
SUSE SLES15: python3-setuptools / python3-setuptools-test / etc (SUSE-SU-2023:0223-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:0223-1 advisory. - CVE-2022-40897: Fixed an excessive CPU usage that could be triggered by fetching a malicious HTML document bsc1206667. Tenable has extracted the...
Security Bulletin: Vulnerability in nth-check affects IBM Process Mining (CVE-2021-3803)
Summary There is a vulnerability in nth-check that could allow a local attacker to launch a DOS attack. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2021-3803 DESCRIPTION: nth-check is...
Fedora 38 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2023-f60cca0686)
The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-f60cca0686 advisory. Upgrade to Ruby on Rails 7.0.4.2. Fixes numerous CVEs: https://rubyonrails.org/2023/1/17/Rails- Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released...
Regular Expression Denial of Service (ReDoS)
Overview zxcvbn is a realistic password strength estimation Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the repeatmatch functionality, due to the usage of an insecure regex in lazyanchored variable. PoC js const zxcvbn = require"zxcvbn";...
nodejs-moment: Regular expression denial of service
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055...
nodejs-moment: Regular expression denial of service
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055...
CVE-2022-25881
A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server...
GHSA-RC47-6667-2J5J http-cache-semantics vulnerable to Regular Expression Denial of Service
http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache poli...
http-cache-semantics vulnerable to Regular Expression Denial of Service
http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache poli...
Withdrawn: safeurl-python contains Server-Side Request Forgery
Withdrawn This advisory has been withdrawn as a duplicate of GHSA-jgh8-vchw-q3g7. Original Description isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...