7754 matches found
GHSA-WWR9-4GMR-XVQ9 H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service DoS attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an...
CVE-2024-10549
CVE-2024-10549 concerns h2oai/h2o-3, version 3.46.0.1, where the vulnerable "/3/Parse" endpoint builds a regex from a user-supplied string and applies it to another user-supplied string. Under concurrent requests, this can exhaust worker threads and cause a denial of service. The issue is trigger...
CVE-2025-0454 SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt
A Server-Side Request Forgery SSRF vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious...
H2O 资源管理错误漏洞
H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A resource management error vulnerability exists in H2O version 3.46.0.1, which stems from the use of a user-specified regular expression in the /3/Parse endpoint and could lead to a denial of service...
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
...
Information Disclosure
parse-git-config is vulnerable to information disclosure. The vulnerability is due to improper handling of key expansion in the expandKeys function, allows an attacker to obtain sensitive information...
yimioa 安全漏洞
yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from the presence of XML external entity injection in the XMLParse component, which allows an attacker to execute arbitrary co...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...
AZL-58641 CVE-2024-8176 affecting package expat for versions less than 2.6.4-1
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash...
CVE-2025-25975
A flaw was found in the parse-git-config package. Affected versions of this package allow an attacker to obtain sensitive information via the expandKeys function...
GHSA-8G77-54RH-46HX Prototype Pollution Vulnerability in parse-git-config
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...
Prototype Pollution Vulnerability in parse-git-config
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...
Prototype Pollution
Overview org.webjars.npm:parse-git-config is a Parse .git/config into a JavaScript object. sync or async. Affected versions of this package are vulnerable to Prototype Pollution via the expandKeys function. An attacker can obtain sensitive information by exploiting the improper handling of key...
CVE-2025-25975
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...
CVE-2025-25975
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...
CVE-2025-25975
The parse-git-config library (specifically version 3.0.0 ) is vulnerable to Prototype Pollution via the expandKeys function. This flaw occurs due to the improper handling of key expansion, which allows an attacker to inject properties into the JavaScript Object.prototype. Practical consequences o...
PT-2025-27690
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A bug in the Linux kernel has been resolved, specifically an out-of-bounds issue in the usbhid parse function. The struct hid descriptor has been updated to reflect the mandatory and...