9793 matches found
Cron Utils 代码注入漏洞
Cron Utils is Jmrozanec individual developers of a Java code base for validating , parsing , migrating Cron expressions . A code injection vulnerability exists in Cron Utils that allows an attacker to inject arbitrary Java EL expressions to execute remote code...
rubygem-date -- Regular Expression Denial of Service Vunlerability of Date Parsing Methods
Stanislav Valkanov reports: Date's parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected...
Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2021-2694)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2021-2719)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2021-2670)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2719)
According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function...
Mozilla Firefox Security Advisory (MFSA2011-42) - Linux
This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
RHEL 8 : python-pillow (RHSA-2021:4149)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4149 advisory. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal...
RHEL 8 : python39:3.9 and python39-devel:3.9 (RHSA-2021:4160)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4160 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
CentOS 8 : python-pillow (CESA-2021:4149)
The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4149 advisory. - python-pillow: Buffer over-read in PCX image reader CVE-2020-35653 - python-pillow: Buffer over-read in SGI RLE image reader CVE-2020-35655 -...
CentOS 8 : python39:3.9 and python39-devel:3.9 (CESA-2021:4160)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4160 advisory. - python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS CVE-2021-28957 - python-ipaddress: Improper input validation ...
EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2694)
According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function...
SUSE SLED12: libpcre1 / libpcre1-32bit / libpcre16-0 / libpcrecpp0 / etc (SUSE-SU-2021:3652-1)
The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3652-1 advisory. Update pcre to version 8.45: - CVE-2020-14155: Fixed integer overflow via a large number after a '?C' substring bsc1172974...
EulerOS 2.0 SP5 : python-pillow (EulerOS-SA-2021-2670)
According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the getrgb function...
SUSE-SU-2021:3652-1 Security update for pcre
This update for pcre fixes the following issues: Update pcre to version 8.45: - CVE-2020-14155: Fixed integer overflow via a large number after a '?C' substring bsc1172974. - CVE-2019-20838: Fixed buffer over-read in JIT compiler bsc1172973. - CVE-2017-7244: Fixed invalid read in pcre32xclass...
SUSE SLES15 Security Update : rubygem-activerecord-5_1 (SUSE-SU-2021:3634-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:3634-1 advisory. - CVE-2021-22880: Fixed possible DoS vector in PostgreSQL money type bsc1182169. Tenable has extracted the preceding description block directly from th...
Denial of Service in extension "Code Highlight" (codehighlight)
The extension bundles a vulnerable version of the 3rd party JavaScript component “prism” which is known to be vulnerable against Regular expression Denial of Service ReDoS...
python: urllib: Regular expression DoS in AbstractBasicAuthHandler
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client such as web browser connects to, could trigger a Regular Expression Denial of Service ReDOS during an authentication request with a specially crafted payload that is sen...
Security Bulletin: A security vulnerability in Node.js axios module affects IBM Cloud Pak for Multicloud Management Managed Services
Summary A security vulnerability in Node.js axios module affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID: CVE-2021-3749 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the trim...