UBUNTU-CVE-2020-36568

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

Memory corruption

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

CVE-2020-36568

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

CVE-2020-36568 Resource exhaustion in github.com/revel/revel

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

CVE-2020-36568

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

CVE-2020-36568

CVE-2020-36568 affects github.com/revel/revel, where the query parser accepts unsanitized input. The issue can trigger resource exhaustion via memory allocation, potentially impacting availability. Public details indicate exploitation would require network access and no user interaction. The vuln...

CVE-2020-36568: Allocation of Resources Without Limits or Throttling

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

QS security vulnerabilities

ljharb qs is a query string parser with nesting support by the individual developer Jordan Harband in the United States. A security vulnerability exists in versions prior to qs 6.10.3, which stems from parse ignoring the proto key, and can be exploited by an attacker to place an attack payload in...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +137 more potentially affected by CVE-2022-2564 via mongoose (>=6.0.1, <=6.4.5)

mongoose NPM version =6.0.1, =1.2.3, =1.0.5, =1.0.9, =1.1.80, =0.0.1, =1.0.13, =1.0.0-rc.1.8.10, =1.0.2, =1.0.3, =0.4.3, =0.4.3, =0.4.3, =2.0.1, =2.0.2 and more Source cves: CVE-2022-2564 Source advisory: OSV:GHSA-F825-F98C-GJ3G...

WS-2021-0192

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation...

@mongodb-js/compass-aggregations (>=0.0.20, <=4.1.0), @mongodb-js/compass-export-to-language (>=2.2.22, <=2.2.24) +4 more potentially affected by CVE-2020-24391 via mongodb-query-parser (>=0.0.1, <=1.5.0)

mongodb-query-parser NPM version =0.0.1, =0.0.20, =2.2.22, =0.0.3, =3.0.0, =1.0.3, =0.0.1, =0.4.2 Source cves: CVE-2020-24391 Source advisory: MEND:CVE-2020-24391...

Remote Code Execution in mongodb-query-parser

Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file: 'function return clearImmediate.constructor"return...

GHSA-97MG-3CR6-3X4C Remote Code Execution in mongodb-query-parser

Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file: 'function return clearImmediate.constructor"return...

PT-2020-21188

Name of the Vulnerable Software and Affected Versions mongodb-query-parser versions prior to 2.0.0 Description The issue concerns a failure to sanitize queries, which allows attackers to execute arbitrary code in the system. This can be achieved by parsing a specific payload, such as the one that...

Security Bulletin: IBM InfoSphere BigInsights 4.2.5 is affected by an Open Source (Solr) vulnerabilty (CVE-2017-12629)

Summary IBM InfoSphere BigInsights 4.2.5 is affected by an Open Source Solr vulnerabilty CVE-2017-12629 Vulnerability Details CVE-ID: CVE-2017-12629 Description: Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a...

Remote Code Execution

Overview Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file: 'function return...

Remote code execution occurs in Apache Solr

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

GHSA-MH7G-99W9-XPJM Remote code execution occurs in Apache Solr

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

Moderate: Red Hat Security Advisory: rh-java-common-lucene5 security update

An update for rh-java-common-lucene5 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution(CVE-2017-12629)

First Vulnerability: XML External Entity Expansion deftype=xmlparser Lucene includes a query parser that is able to create the full-spectrum of Lucene queries, using an XML data structure. Starting from version 5.1 Solr supports "xml" query parser in the search query. The problem is that lucene x...