596 matches found
Inefficient Regular Expression Complexity in Loofah
Summary Loofah = 2.19.1. Severity The Loofah maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly reported by @ooooooo-q...
PT-2022-16044
Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.19.1 Description Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It contains an inefficient regular expression that is susceptible to excessiv...
Moderate: Red Hat Security Advisory: RHOSDT 2.6.0 operator/operand containers Security Update
An update is now available for Red Hat Openshift distributed tracing 2.6.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
Debian dla-3149 : ruby-nokogiri - security update
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3149 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3149-1 [email protected]...
GHSA-XRX9-GJ26-5WX9 v8n vulnerable to Inefficient Regular Expression Complexity
Impact Inefficient regular expression complexity of lowercase and uppercase regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeati + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase. The same issue happens with uppercase...
v8n vulnerable to Inefficient Regular Expression Complexity
Impact Inefficient regular expression complexity of lowercase and uppercase regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeati + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase. The same issue happens with uppercase...
The vulnerability of the Nokogiri library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the Nokogiri library lies in the use of an inefficient regular expression. Exploiting this vulnerability allows a remote attacker to cause a service failure...
The vulnerability of the AbstractBasicAuthHandler class in the urllib.request component of the Python programming language allows a hacker to trigger a denial-of-service attack.
The vulnerability of the AbstractBasicAuthHandler class in the urllib.request component of the Python programming language is related to the use of an inefficient regular expression. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
Oracle Linux 8 : nodejs:16 (ELSA-2022-6449)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6449 advisory. - CVE fixes for CVE-2022-32212/3/4/5 - Resolves CVE-2022-33987 Tenable has extracted the preceding description block directly from the Oracle Linux...
CVE-2022-36064
Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells Bash and Dash, or any not-officially-supported Unix shell; and/or using the escape or escapeAll functions with the...
PT-2022-23152 · Shescape · Shescape
Name of the Vulnerable Software and Affected Versions: Shescape versions prior to 1.5.10 Shescape version 1.5.9 for Bash Description: An Inefficient Regular Expression Complexity issue affects Shescape users who utilize it to escape arguments for Unix shells, including Bash and Dash, particularly...
RHEL 8 : Red Hat OpenShift Service Mesh 2.0.11 (RHSA-2022:6272)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6272 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift...
CVE-2022-35923
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the lowercase and uppercase regex which could lead to a denial of service attack. In testing of the lowercase function a payload of 'a' + 'a'.repeati + 'A' wit...
Design/Logic Flaw
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the lowercase and uppercase regex which could lead to a denial of service attack. In testing of the lowercase function a payload of 'a' + 'a'.repeati + 'A' wit...
CVE-2022-35923 Inefficient Regular Expression Complexity in v8n
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the lowercase and uppercase regex which could lead to a denial of service attack. In testing of the lowercase function a payload of 'a' + 'a'.repeati + 'A' wit...
CVE-2022-2596
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10...
CVE-2022-2596
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10...
UBUNTU-CVE-2022-2596
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10...
CVE-2022-2596
CVE-2022-2596 affects node-fetch/node-fetch prior to 3.2.10, where an inefficient regular expression can lead to denial of service. The root cause is a ReDoS in isOriginPotentiallyTrustworthy() within referrer.js. Public advisories (GitHub GHSA) confirm the vulnerability and indicate the fix is t...
