IBM Cognos Analytics 11.2.x < 11.2.4 FP5 / 12.0.x < 12.0.4 IF1 Multiple Vulnerabilities (7179496)

The version of IBM Cognos Analytics installed on the remote host is prior to 11.2.4 FP5 or 12.0.4 IF1. It is, therefore, affected by multiple vulnerabilities as referenced in the 7179496 advisory. - IBM Cognos Analytics is vulnerable to an Expression Language EL Injection vulnerability. A remote...

PT-2025-40896

Name of the Vulnerable Software and Affected Versions MediaWiki DiscussionTools extension affected versions not specified Description A Regular Expression Denial-of-Service issue exists in the DiscussionTools extension, which is included with MediaWiki, the software that powers Wikipedia. This ca...

PT-2026-7637

Name of the Vulnerable Software and Affected Versions ajv versions through 8.17.1 Description ajv Another JSON Schema Validator is susceptible to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data through JSON Pointer syntax $data...

Exploit for CVE-2024-54152

⚙️🔨 IN PROGRESS CVE-2024-54152 POC Angular Expressions...

python-sql SQL injection vulnerability

A vulnerability was found in python-sql where unary operators do not escape non-Expression like And and Or which makes any system exposing those vulnerable to an SQL injection attack...

DEBIAN-CVE-2024-9774

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

UBUNTU-CVE-2024-9774

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774 Python-sql: python-sql unary operators does not escape non-expression

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774 Python-sql: python-sql unary operators does not escape non-expression

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774

CVE-2024-9774 affects the Python-sql library where unary operators do not escape non-Expression. Public sources reference a fix in version 1.5.2 (Fedora/openSUSE advisories), with advisories noting updated packages to address the issue. The CVE entry lists CVSSv3 metrics (base score 6.5, MEDIUM) ...

CVE-2024-9774

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

CVE-2024-9774: Improper Neutralization of Escape, Meta, or Control Sequences

A vulnerability was found in python-sql where unary operators do not escape non-Expression...

IBM Cognos Analytics Expression Language Injection

The vulnerability of the online business analytics service IBM Cognos Analytics lies in the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected informatio...

Node.js Cross-Spawn DoS

The vulnerability of the Node.js software platform’s cross-spawn package, related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Vulnerabilities fixed in IBM Cognos Analytics

IBM fixed vulnerabilities in IBM Cognos Analytics The vulnerability in IBM Cognos Analytics arises from improper validation of file extensions, allowing remote attackers to upload arbitrary files. This security issue can lead to the execution of malicious code on the affected system, posing a...

Arbitrary Code Execution (ACE)

angular-expressions is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to ability to escape the sandbox through a malicious expression, allowing an attacker to execute arbitrary code on the system...

OSV-2024-1397 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=385326423 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.HashMap.get org.springframework.core.convert.TypeDescriptor.valueOf...