3765 matches found
192.168.0.172 (4.6.1), 3loc (>=0.2.0, <=0.4.0) +3501 more potentially affected by CVE-2017-15010 via tough-cookie (>=2.0.0, <=2.3.2)
tough-cookie NPM version =2.0.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =2.1.0, =0.0.0, =0.1.0-alpha.1, =1.0.1, =0.11.0-atomist-update-branch-master-1541106195325.20181102202646, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-2018081515595...
method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header
Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header. Recommendation Update to version 2.3.10 or later...
ReDoS via long UserAgent header in useragent
Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed. Proof of Concept js var useragent = require'useragent'; var badUserAgent = 'MSIE 0.0'+Array900000.join'0'+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agen...
ReDoS via long UserAgent header in ua-parser
Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header. Recommendation No patch is currently available for this vulnerability. The best mitigation is currently to avoid using this package, using a different,...
Regular Expression Denial Of Service (ReDoS)
validator is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a base64 string that when validated by the application will cause a ReDoS attack...
Regular Expression Denial Of Service (ReDoS)
validator is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a long URI to the isDataURI function to cause a ReDoS attack...
Regular Expression Denial Of Service (ReDoS)
jasmine-core is vulnerable to a Regular Expression Denial of Service ReDoS attack. The regular expression ^\sfunction\s\w\s\ is used to obtain the function name from the JS toString output of a function, which can result in a matching time of approximately 10 seconds for data that is 64K...
CVE-2018-13863
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
CVE-2018-13863
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
Design/Logic Flaw
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
Security Bulletin: Two ReDoS vulnerabilities in modules included in the Node.js npm tool
Summary Two ReDoS vulnerabilities in modules included in the Node.js npm tool shipped by IBM Rational Application Developer for WebSphere Software. Vulnerability Details CVEID: CVE-2016-2515 DESCRIPTION: Node.JS hawk is vulnerable to a denial of service, caused by an error in the regular expressi...
Regular Expression Denial Of Service (ReDoS)
no-case is vulnerable to regular expression denial of service ReDoS attacks. The library does not properly sanitize user input strings, causing slowdown when matching strings that can lead to a ReDoS...
Regular Expression Denial Of Service (ReDoS)
charset is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string to the through the HTTP header to cause a ReDoS attack...
Regular Expression Denial Of Service (ReDoS)
ua-parser is vulnerable to regular expression denial of service ReDoS. A malicious user can pass a string through the User-Agent header to cause a ReDoS...
Regular Expression Denial Of Service (ReDoS)
method-override is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability exists when parsing malicious X-HTTP-Method-Override header...
spring-framework: ReDoS Attack with spring-messaging
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...
CVE-2018-3738
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...
CVE-2018-3737
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...