PT-2022-37326 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported. The crash involves the onig node str cat function, and the call stack includes parse exp and parse...

PT-2022-24866 · Pypi · Dparse

Name of the Vulnerable Software and Affected Versions: dparse versions prior to 0.5.2 Description: dparse is a parser for Python dependency files. The issue concerns a regular expression that is vulnerable to a Regular Expression Denial of Service ReDoS. All users parsing index server URLs with...

PT-2022-37310 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: java versions affected versions not specified Description: The issue is related to a security exception. Technical details about the crash include the Parser.parseConditionalExpression function and the CESU 8$Encoder.encodeLoop method in...

Nextcloud: [nextcloud/server] Moment.js vulnerable to Inefficient Regular Expression Complexity

Describe the bugs: 🐛 moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the preprocessRFC2822 function in from-string.js, when processing a...

PT-2022-16005 · Nepxion · Nepxion Discovery

Name of the Vulnerable Software and Affected Versions: Nepxion Discovery affected versions not specified Description: The issue is related to SpEL Injection in discovery-commons, where the DiscoveryExpressionResolver’s eval method evaluates expressions with a StandardEvaluationContext. This allow...

Nepxion 安全漏洞

Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...

USN-5627-2: PCRE vulnerabilities

USN-5627-1 fixed several vulnerabilities in PCRE. This update provides the corresponding fixes for Ubuntu 18.04 ESM. Original advisory details: It was discovered that PCRE incorrectly handled memory when handling certain regular expressions. An attacker could possibly use this issue to cause...

CVE-2022-40023

A vulnerability was found in the mako package. Affected versions of this package are vulnerable to Regular expression denial of service ReDoS attacks, affecting system availability...

personnummer/rust vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

GHSA-28R9-PQ4C-WP3C personnummer/rust vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

Regular Expression Denial Of Service (ReDoS)

steal is vulnerable to regular expression denial of service. A remote attacker is able to supply a malicious input through the string variables in babel.js causing a hang in the system...

steal Inefficient Regular Expression Complexity vulnerability via string variable

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

GHSA-RGQX-226F-2XP4 steal Inefficient Regular Expression Complexity vulnerability via string variable

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

The vulnerability of the OGNL expression transformation class implementation in the Apache Struts software platform allows a hacker to execute arbitrary code.

The vulnerability of the OGNL expression transformation class implementation in the Apache Struts software framework is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted request...

Debian dla-3116 : python-mako - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3116 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3116-1 [email protected] https://www.debian.org/lts/security/...

CVE-2022-37259

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

Design/Logic Flaw

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

CVE-2022-37259

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

CVE-2022-37259

CVE-2022-37259 affects stealjs/steal version 2.2.4. The root cause is a Regular Expression Denial of Service (ReDoS) flaw exposed via a string variable in babel.js. The CVSS metrics indicate Network attack vector, low attack complexity, no privileges or user interaction, with availability impact ...

Ruby: Double free in Regexp compilation

A double-free vulnerability was found in Ruby. The issue occurs during Regexp compilation. This flaw allows an attacker to create a Regexp object with a crafted source string that could cause the same memory to be freed twice...