15773 matches found
libnbd Security Vulnerabilities
libnbd is a library for editing NBD Network Block Device clients. A security vulnerability exists in libnbd that stems from an inability to properly handle the return value of the nbdgetsize function, which could lead to application crashes or other unexpected behavior on the client...
Chaijs/get-func-name vulnerable to ReDoS
The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows: js const functionNameMatch = /\sfunction?:\s|\s/^?:/+\/\s^\s/+/; This vulnerability can be exploited...
GHSA-4Q6P-R6V2-JVC5 Chaijs/get-func-name vulnerable to ReDoS
The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows: js const functionNameMatch = /\sfunction?:\s|\s/^?:/+\/\s^\s/+/; This vulnerability can be exploited...
@hyperledger-cacti/cacti-copm-core (>=3.0.0-alpha.5, <=3.0.0-beta.1), @hyperledger-cacti/cacti-copm-test (>=3.0.0-alpha.5, <=3.0.0-beta.1) +7 more potentially affected by CVE-2023-43646 via get-func-name (2.0.0)
get-func-name NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on get-func-name and may be impacted: - @hyperledger-cacti/cacti-copm-core =3.0.0-alpha.5, =3.0.0-alpha.5, =3.0.0-alpha.5, =3.0.0-alpha.5, =3.0.0-alpha.5, =3.0.0-alpha.5,...
CVE-2023-20109
A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause...
Input validation
A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause...
CVE-2023-20109
CVE-2023-20109 affects Cisco IOS and IOS XE GET VPN. Root cause: insufficient validation of GDOI/G-IKEv2 attributes in GET VPN, enabling an authenticated admin on a group member or key server to execute arbitrary code or crash the device. Impact (as stated): full device control or reboot/DoS. Rem...
CVE-2023-20109
A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause...
Cisco IOS and IOS XE Software Cisco Group Encrypted Transport VPN Software Out-of-Bounds Write Vulnerability
A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause...
CVE-2023-43646
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...
DEBIAN-CVE-2023-43646
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...
UBUNTU-CVE-2023-43646
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...
CVE-2021-38243
xunruicms up to v4.5.1 was discovered to contain a remote code execution RCE vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request...
Design/Logic Flaw
xunruicms up to v4.5.1 was discovered to contain a remote code execution RCE vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request...
VulnCheck KEV: CVE-2023-20109
Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN GET VPN feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash...
Tenda AC10 缓冲区错误漏洞
Tenda AC10U is a dual-band Gigabit wireless router from Tenda Technology, designed for 200 megabit and above fiber optic homes, supporting 802.11ac dual-band technology 2.4GHz and 5GHz, with a theoretical WiFi rate of up to 867Mbps. The Tenda AC10U suffers from a stack buffer overflow vulnerabili...
get-func-name Security Vulnerability
get-func-name is a Chaijs open source module for securely and consistently retrieving function names in NodeJS and browsers. A security vulnerability exists in get-func-name versions prior to 2.0.1, which stems from a regular expression denial-of-service redos vulnerability in the system that cou...
CVE-2023-43646
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...
CVE-2023-43646 Inefficient Regular Expression Complexity in get-func-name
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service redos vulnerability which may lead to a denial of service when parsing malicious input. This vulnerabilit...
CVE-2023-43646
CVE-2023-43646 affects the get-func-name module (NodeJS and browser) where versions before 2.0.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) caused by imbalance in parentheses that triggers catastrophic backtracking and high CPU usage on malicious input (e.g., a tab-heavy str...