H2O Resource Management Error Vulnerability

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A resource management error vulnerability exists in H2O version 3.46.0.1, which stems from the use of a user-specified regular expression in the /3/Parse endpoint and could lead to a denial of service...

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.

...

Information Disclosure

parse-git-config is vulnerable to information disclosure. The vulnerability is due to improper handling of key expansion in the expandKeys function, allows an attacker to obtain sensitive information...

yimioa security vulnerabilities

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from the presence of XML external entity injection in the XMLParse component, which allows an attacker to execute arbitrary co...

PT-2025-16757

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically in the ice vc fdir parse raw function. The issue involved using an untrusted value of pkt len without proper...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...

javaparser:parseFuzzer: Security exception in com.github.javaparser.CommentsInserter.insertComments

Detailed Report: https://oss-fuzz.com/testcase?key=5288750892777472 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

AZL-58641 CVE-2024-8176 affecting package expat for versions less than 2.6.4-1

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash...

CVE-2025-25975

A flaw was found in the parse-git-config package. Affected versions of this package allow an attacker to obtain sensitive information via the expandKeys function...

Prototype Pollution Vulnerability in parse-git-config

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

GHSA-8G77-54RH-46HX Prototype Pollution Vulnerability in parse-git-config

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

0xrtest (1.0.0), 51xtong (>=1.0.2, <=1.0.8) +1090 more potentially affected by CVE-2025-25975 via parse-git-config (3.0.0)

parse-git-config NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-git-config and may be impacted: - 0xrtest 1.0.0 - 51xtong =1.0.2, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.2, =0.0.11, =1.0.0, =11.1.0, =0.0.1, =0.0.1, =0.1.2 and more...

0xrtest (1.0.0), 51xtong (>=1.0.2, <=1.0.8) +1090 more potentially affected by CVE-2025-25975 via parse-git-config (3.0.0)

parse-git-config NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-git-config and may be impacted: - 0xrtest 1.0.0 - 51xtong =1.0.2, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.2, =0.0.11, =1.0.0, =11.1.0, =0.0.1, =0.0.1, =0.1.2 and more...

Prototype Pollution

Overview org.webjars.npm:parse-git-config is a Parse .git/config into a JavaScript object. sync or async. Affected versions of this package are vulnerable to Prototype Pollution via the expandKeys function. An attacker can obtain sensitive information by exploiting the improper handling of key...

CVE-2025-25975

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

CVE-2025-25975

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function...

PT-2025-11119

Name of the Vulnerable Software and Affected Versions: parse-git-config version 3.0.0 Description: The issue allows an attacker to obtain sensitive information via the expandKeys function. Recommendations: For parse-git-config version 3.0.0, consider disabling the expandKeys function until a patc...

CVE-2025-25975

The parse-git-config package (version 3.0.0 ) is vulnerable to Prototype Pollution via the expandKeys function. An attacker can exploit improper handling of key expansion to inject properties into the JavaScript Object.prototype chain. This can lead to denial of service (DoS) , remote code execut...