Ubuntu 18.04 LTS : Python vulnerabilities (USN-5199-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5199-1 advisory. It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex with a quadratic worst-case time complexity. Specially...

Ubuntu 18.04 LTS : Python vulnerabilities (USN-5200-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5200-1 advisory. It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex allowing for catastrophic backtracking. Specially craft...

Ubuntu: Security Advisory (USN-5200-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Regular Expression Denial of Service (ReDoS) in jsx-slack

jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service ReDoS attack. Impact If attacker can put a lot of JSX elements into tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. javascript /...

GHSA-55XV-F85C-248Q Regular Expression Denial of Service (ReDoS) in jsx-slack

jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service ReDoS attack. Impact If attacker can put a lot of JSX elements into tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. javascript /...

Code injection

jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service ReDoS attack. If attacker can put a lot of JSX elements into tag, an internal regular expression for escaping character...

CVE-2021-43838 Regular Expression Denial of Service (ReDoS) in jsx-slack

jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service ReDoS attack. If attacker can put a lot of JSX elements into tag, an internal regular expression for escaping character...

USN-5200-1: Python vulnerabilities

It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex allowing for catastrophic backtracking. Specially crafted traffic from a malicious HTTP server could cause a regular expression denial of service ReDoS condition for a client. CVE-2020-8492 It was...

PT-2021-23969 · Jsx-Slack · Jsx-Slack

Name of the Vulnerable Software and Affected Versions: jsx-slack versions prior to 4.5.1 Description: The issue concerns a regular expression denial-of-service ReDoS attack. If an attacker can put a lot of JSX elements into the tag, an internal regular expression for escaping characters may consu...

PT-2021-23973 · Jsx-Slack · Jsx-Slack

Name of the Vulnerable Software and Affected Versions: jsx-slack versions 4.5.1 and earlier Description: The issue is related to a Regular Expression Denial of Service ReDoS attack. If an attacker can put a lot of JSX elements into the tag with including multibyte characters, an internal regular...

CVE-2021-38244

A regular expression denial of service ReDoS vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json...

CVE-2021-38244

A regular expression denial of service ReDoS vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json...

nodejs-glob-parent: Regular expression denial of service

A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent...

nodejs-normalize-url: ReDoS for data URLs

A flaw was found in normalize-url. Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data...

RHEL 8 : nodejs:16 (RHSA-2021:5171)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5171 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

CVE-2021-43836 PHP file inclusion in the Sulu admin panel

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18...

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16.13.1, nodejs-nodemon 2.0.15. BZ2027610 Security Fixes: nodejs-json-schema:...

Exploit for Expression Language Injection in Apache Log4J

tejas-nagchandi/CVE-2021-45046 Attack !imagehttps://use...

Exploit for Expression Language Injection in Apache Log4J

Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046 Attack...

jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid...