transformers 安全漏洞

transformers is a Hugging Face open source application for machine learning. A security vulnerability exists in transformers version v4.48.3, which stems from improper handling of regular expressions in the preprocessstring function and could lead to a regular expression denial of service attack...

WordPress plugin Jetpack 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Alibaba Cloud Linux 3 : 0149: pcre2 (ALINUX3-SA-2022:0149)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0149 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-1586: An out-of-bounds read vulnerability...

go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

The vulnerability of Mozilla Firefox and Firefox ESR browsers, as well as the Thunderbird email client, stems from an operation that goes beyond the buffer boundaries in memory. This allows attackers to gain unauthorized access to protected information.

The vulnerabilities of Mozilla Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to the issue of executing operations beyond the buffer boundaries in memory during the processing of XPath expressions. Exploiting this vulnerability can allow an attacker to gain...

CVE-2025-4318 Input validation issue in AWS Amplify Studio UI component properties

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

Amplify Codegen UI 安全漏洞

Amplify Codegen UI is an AWS Amplify open source React component generated for use in the AWS Amplify project. A security vulnerability exists in Amplify Codegen UI that stems from a lack of input validation for AWS Amplify Studio UI component property expressions, which could lead to the executi...

Security Bulletin: Multiple vulnerabilities affect IBM Business Automation Workflow - CVE-2025-27789, CVE-2024-57965, CVE-2025-27152, CVE-2024-55565

Summary Some IBM Business Automation Workflow user interfaces may be affected by vulnerabilities in JavaScript libraries. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and...

The vulnerability of the CGI Gem software lies in the use of regular expressions with inefficient computational complexity, which allows attackers to trigger a service failure.

The vulnerability of the CGI Gem software lies in the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability allows an attacker operating remotely to cause service interruptions...

uBlock Origin 安全漏洞

uBlock Origin uBO is an efficient blocker for uBlock Origin-Chromium and Firefox by Raymond Hill Personal Developer. A security vulnerability exists in uBlock Origin 1.63.3b16 and earlier versions, which stems from improper regular expression complexity and could lead to a denial of service attac...

transformers 安全漏洞

transformers is a Hugging Face open source application for machine learning. A security vulnerability exists in transformers version 4.48.1, which stems from exponential complexity in regular expressions when processing specially crafted inputs, potentially leading to a denial of service...

Amazon Linux 2 : docker (ALASECS-2025-059)

The version of docker installed on the remote host is prior to 20.10.17-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-059 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read t...

Amazon Linux 2 : runc (ALASDOCKER-2025-059)

The version of runc installed on the remote host is prior to 1.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-059 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Amazon Linux 2 : runc (ALASECS-2025-058)

The version of runc installed on the remote host is prior to 1.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-058 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-058)

The version of containerd installed on the remote host is prior to 1.6.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-058 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could...

Medium: containerd

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2025-056)

The version of runc installed on the remote host is prior to 1.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-056 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause...

ROS-20250417-12

Vulnerability in cgi gem software tool due to insufficient input validation when processing unreliable input using regular expressions in CGI::UtilescapeElement. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service Vulnerability in the cgi gem...

Prototype Pollution

estree-util-value-to-estree is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of object properties due to generating ESTree expressions that interpret proto as a prototype rather than a normal property...

The vulnerability of the tracing component of the eventtrigger_write function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the tracing component of the eventtriggerwrite function in Linux kernel is related to insufficient handling of regular expressions. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...