13429 matches found
CVE-2023-47038
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. Mitigation Mitigation for this issue is either not available or the currently...
GLSA-202311-09 : Go: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202311-09 Go: Multiple Vulnerabilities - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource...
CVE-2023-47038
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer...
Perl Buffer Error Vulnerability
Perl is a general-purpose, interpreted, dynamic cross-platform programming language from the PERL community. A buffer error vulnerability exists in Perl versions 5.30.0 through 5.38.0 that originates when Perl compiles a carefully crafted regular expression, allowing an attacker to control a byte...
SUSE-SU-2023:4517-1 Security update for python3-setuptools
This update for python3-setuptools fixes the following issues: - CVE-2022-40897: Fixed Regular Expression Denial of Service ReDoS in packageindex.py bsc1206667...
pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py
A flaw was found in Python Setuptools due to a regular expression Denial of Service ReDoS present in packageindex.py. This issue could allow a remote attacker to cause a denial of service via HTML in a crafted package or custom PackageIndex page...
CVE-2023-48223
fast-jwt provides fast JSON Web Token JWT implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. ...
Type confusion
fast-jwt provides fast JSON Web Token JWT implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. ...
CVE-2023-48223 fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token JWT implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. ...
CVE-2023-48223 fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token JWT implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. ...
GHSA-3F2Q-6294-FMQ5 Inefficient Regular Expression Complexity in git-urls
git-urls version 1.0.1 is vulnerable to ReDOS Regular Expression Denial of Service in Go package...
CVE-2023-46402
git-urls 1.0.0 allows ReDOS Regular Expression Denial of Service in urls.go...
CVE-2023-46402
git-urls 1.0.0 allows ReDOS Regular Expression Denial of Service in urls.go...
CVE-2023-46402
git-urls 1.0.0 allows ReDOS Regular Expression Denial of Service in urls.go...
git-urls Security Vulnerabilities
git-urls is a Go library from Will Maier's personal developer. It is used to parse Git URLs. A security vulnerability exists in git-urls version 1.0.1. An attacker could exploit this vulnerability to conduct a regular expression denial of service attack...
CVE-2023-26364 Denial of Service of regular expression in package @adobe/css-tools
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges...
CVE-2023-46402
git-urls 1.0.0 allows ReDOS Regular Expression Denial of Service in urls.go...
PT-2023-30003 · Git-Urls · Git-Urls
Name of the Vulnerable Software and Affected Versions: git-urls version 1.0.1 git-urls version 1.0.0 Description: The issue is related to ReDOS Regular Expression Denial of Service in the Go package. This can cause a denial of service in the urls.go file. Recommendations: For git-urls version...
New PoC Exploit for Apache ActiveMQ Flaw Could Let Attackers Fly Under the Radar
Cybersecurity researchers have demonstrated a new technique that exploits a critical security flaw in Apache ActiveMQ to achieve arbitrary code execution in memory. Tracked as CVE-2023-46604 CVSS score: 10.0, the vulnerability is a remote code execution bug that could permit a threat actor to run...
Medium: ruby
Issue Overview: A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this...