Prism 安全漏洞

Prism is an application from the US-based individual developers of Prism. It is a lightweight, extensible syntax highlighting tool. Prism suffers from a security vulnerability that stems from Prism's susceptibility to inefficient regular expression complexity...

EulerOS 2.0 SP2 : exiv2 (EulerOS-SA-2021-2367)

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read w...

Inefficient Regular Expression Complexity in clean-css/clean-css

✍️ Description It allows cause a denial of service when calling function isDataUriResource. 🕵️‍♂️ Proof of Concept // PoC.js var isDataUriResource = require"clean-css/lib/utils/is-data-uri-resource" forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = 'data:' +...

Inefficient Regular Expression Complexity in prismjs/prism

✍️ Description The prismjs package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex. 🕵️‍♂️ Proof of Concept...

StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)

Impact The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Patches The...

PT-2021-5798

Name of the Vulnerable Software and Affected Versions ansi-regex affected versions not specified Description The issue is related to Inefficient Regular Expression Complexity, which could lead to a denial of service when parsing invalid ANSI escape codes. This can be exploited by a remote attacke...

Inefficient Regular Expression Complexity in daaku/nodejs-tmpl

✍️ Description It allows cause a denial of service when formatting crafted string. 🕵️‍♂️ Proof of Concept // PoC.js var tmpl = require"tmpl" forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = ""+"".repeati10000+"answer"; tmplattackstr, answer: 42 var timecost = Date.now - time;...

GHSA-CPH5-M8F7-6C5X axios Inefficient Regular Expression Complexity vulnerability

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity...

axios Inefficient Regular Expression Complexity vulnerability

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity...

Design/Logic Flaw

axios is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity...

UBUNTU-CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3749 Inefficient Regular Expression Complexity in axios/axios

axios is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3749

CVE-2021-3749 affects the Axios package used by IBM Cloud Pak System and Node.js environments. It is a Denial of Service vulnerability via a regular-expression DoS in the trim function, exploitable by crafted input to cause high CPU usage. Remediation is to upgrade to fixed software; IBM Cloud Pa...

CVE-2021-3749

axios is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3649

chatwoot is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3649

chatwoot is vulnerable to Inefficient Regular Expression Complexity...

Design/Logic Flaw

chatwoot is vulnerable to Inefficient Regular Expression Complexity...

Jinja: Denial of service

Background Jinja is a template engine written in pure Python. Description The ‘urlize’ filter in Jinja utilized an inefficient regular expression that could be exploited to consume excess CPU. Impact An attacker could cause a Denial of Service condition via crafted input to the ‘urlize’ Jinja...