2564 matches found
py-matrix-synapse -- malicious push rules may be used for a denial of service attack.
Matrix developers report: "Push rules" can specify conditions under which they will match, including eventmatch, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processi...
GHSA-VH6R-G38F-Q3W8 Validation bypass in jpv
jpv aka Json Pattern Validator before 2.2.2 does not properly validate input, as demonstrated by a corrupted array...
Validation bypass in jpv
jpv aka Json Pattern Validator before 2.2.2 does not properly validate input, as demonstrated by a corrupted array...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection. It used to call Kernelopen to open a local file. If a Ruby project hasa file whose name starts with | and ends with tags, the command followingthe pipe character is executed. A malicious Ruby project could exploit it...
CVE-2021-31856
A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint order parameter in GetMesheryPatterns in models/mesherypatternpersister.go...
Regular Expression Denial Of Service (ReDoS)
postcss is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure usage of regex sub-pattern /\\s sourceMappingURL=. via getAnnotationURL and loadAnnotation in lib/previous-map.js...
Initialization can be front-run in USDV.sol
Handle 0xRajeev Vulnerability details Impact Given the public access, this is susceptible to front-running by an attacker who can initialize this with arbitrary assets before the deployer. Reinitialization will require contract redeployment because initialization can be done only once. Reference:...
DAO functions can be called before initialization in init() of DAO.sol
Handle 0xRajeev Vulnerability details Impact All the external/public functions of DAO.sol can be called by other contracts even before DAO.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...
Vader functions can be called before initialization in init() of Vader.sol
Handle 0xRajeev Vulnerability details Impact All the external/public functions of Vader.sol can be called by other contracts even before Vader.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...
Initialization can be front-run in DAO.sol
Handle 0xRajeev Vulnerability details Impact Given the public access, this is susceptible to front-running by an attacker who can initialize this with arbitrary assets before the deployer. Reinitialization will require contract redeployment because initialization can be done only once. Reference:...
Pool functions can be called before initialization in init() of Pools.sol
Handle 0xRajeev Vulnerability details Impact All the external/public functions of Pools.sol can be called by other contracts even before Pools.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...
CVE-2021-23382
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=...
postcss 安全漏洞
Andrey Sitnik postcss is an open source application by Andrey Sitnik . Tool for converting styles using JS plug-ins . postcss 8.2.13 version before a security vulnerability , the vulnerability stems from vulnerability to regular expression denial-of-service attacks , vulnerable regular expression...
Columbo - A Computer Forensic Analysis Tool Used To Simplify And Identify Specific Patterns In Compromised Datasets
Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromised Window...
Regular Expression Denial of Service (ReDoS) in Jinja2
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiti...
GHSA-G3RQ-G295-4J3M Regular Expression Denial of Service (ReDoS) in Jinja2
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiti...
Fedora: Security Advisory for rubygem-activerecord (FEDORA-2021-b571fca1b8)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2021-20276
A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcrecompile may lead to denial of service...