CVE-2020-15143

CVE-2020-15143 affects the SyliusResourceBundle. Affected versions are prior to 1.3.14, 1.4.7, 1.5.2 and 1.6.4, where request parameters injected into expressions evaluated by the Symfony expression-language package were not properly sanitized. This allows an attacker to access any public service...

CVE-2020-15143 Remote Code Execution in SyliusResourceBundle

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter,...

CVE-2020-15146 Remote Code Execution in SyliusResourceBundle

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter,...

CVE-2020-15146

CVE-2020-15146 affects SyliusResourceBundle used with Symfony. The vulnerability occurs when request parameters are injected into expressions evaluated by the Symfony expression-language, allowing an attacker to access public services and perform Remote Code Execution. Affected versions are

GHSA-H6M7-J4H3-9RF5 Remote Code Execution in SyliusResourceBundle

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...

Remote Code Execution in SyliusResourceBundle

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...

In the GNU C Library (aka glibc or libc6) through 2.29 check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.

...

Prototype Pollution

Overview property-expr is a tiny util for getting and setting deep object props safely Affected versions of this package are vulnerable to Prototype Pollution via the setter function. POC var expr = require'property-expr'; expr.setter'proto.polluted', true; console.logpolluted; // true Details...

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

Remote Code Execution (RCE)

struts2-core is vulnerable to remote code execution RCE. The vulnerability exists through the possibility of a forced double OGNL expression through the $itemValue expression in simple/radiomap.ftl...

The moment.js version 2.9.0 is vulnerable to regular expression denial of service

h3. Issue Summary Bamboo uses moment.js version 2.9.0 which is vulnerable to regular expression denial of service. For additional details see https://github.com/moment/moment/issues/2936 and https://www.npmjs.com/advisories/55. h3. Suggested Solution Upgrade moment.js to version = 2.11.2...

Regular Express Denial Of Service (ReDoS)

wappalyzer is vulnerable to denial of service DoS. The vulnerability exists as it uses a regular expression that does not restrict the amount of 0-9., allowing a long string to exhaust memory...

RHEL 8 : java-1.8.0-openjdk (RHSA-2020:1515)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1515 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

Integer Overflow

Perl has an integer overflow related to mishandling of a "PLregkindOPn == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection...

Denial Of Service (DoS)

perl is vulnerable to denial of service DoS. The vulnerability exists through a buffer overflow via a crafted regular expression because of recursive Sstudychunk calls...

Amazon Linux 2 : python, python3 (ALAS-2020-1471)

The version of python installed on the remote host is prior to 2.7.18-1. The version of python3 installed on the remote host is prior to 3.7.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1471 advisory. 2023-10-25: CVE-2022-48560 was added to this...

Medium: python, python3

Issue Overview: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic...

EulerOS 2.0 SP8 : perl (EulerOS-SA-2020-1820)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Perl before 5.30.3 has an integer overflow related to mishandling of a 'PLregkindOPn == NOTHING' situation. A crafted regular expression could lea...