Remote Code Execution via traversal in TAL expressions

This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Impact Most Python modules are not available for using in TAL expressions that you can add...

CVE-2021-32674

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

CVE-2021-32674

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

PYSEC-2021-104

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

PYSEC-2021-104

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

Design/Logic Flaw

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL...

CVE-2021-32674

Zope TAL expression traversal vulnerabilities allow untrusted code execution when Zope Page Templates are edited by web users with sufficient permissions. Affected: Zope open-source web application server; root cause: TAL expression evaluation can indirectly access untrusted Python modules. Impac...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

CVE-2021-23392 Regular Expression Denial of Service (ReDoS)

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

urllib3 vulnerable to Regular expression Denial-of-Service (ReDoS)

Overview urllib3 contains a Regular expression Denial-of-Service DoS vulnerability. urllib3, an HTTP client module for Python, contains a Regular expression Denial-of-Service ReDoS vulnerability CWE-400, CVE-2021-33503 due to catastrophic backtracking while processing a malicious URL. Nariyoshi...

Uncontrolled Resource Consumption in trim-newlines

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service ReDoS for the .end method...

GHSA-C56F-GRV3-GPFR Regular expression denial of service in forms

The package forms before 1.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via email validation...

Regular expression denial of service

Overview glob-parent before 5.1.2 has a regular expression denial of service vulnerability. The enclosure regex used to check for strings ending in enclosure containing path separator. Recommendation Upgrade to version 5.1.2 or later References - CVE - GitHub Advisory...

glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator...

GHSA-WW39-953V-WCQ6 glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator...

Security update for python-py (moderate)

openSUSE Security Update: Security update for python-py Announcement ID: openSUSE-SU-2021:0851-1 Rating: moderate References: 1179805 1184505 Cross-References: CVE-2020-29651 CVSS scores: CVE-2020-29651 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29651 SUSE: 5.5...

FreeBSD : tauthon -- Regular Expression Denial of Service (c7855866-c511-11eb-ae1d-b42e991fc52e)

The :class:urllib.request.AbstractBasicAuthHandler class of the :mod:urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

CKEditor Resource Management Error Vulnerability (CNVD-2021-39674)

CKEditor is an open source, web-based text editor. CKEditor 5 suffers from a resource management error vulnerability that stems from a regular expression denial of service ReDoS vulnerability. The vulnerability allows misuse of a specific regular expression, which could result in a significant...

DEBIAN-CVE-2020-28469

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator...

ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network...