PT-2022-14933 · Css-What +2 · Css-What +2

Name of the Vulnerable Software and Affected Versions: css-what versions prior to 2.1.3 Description: The issue is related to a Regular Expression Denial of Service ReDoS due to the usage of an insecure regular expression in the re attr variable of index.js. This could be triggered via the parse...

d3-color vulnerable to ReDoS

The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds...

@candrewsintegralblue/snyk (0.0.4), @commerce-apps/raml-toolkit (>=0.5.8, <=0.5.10) +2 more potentially affected by CVE-2022-22984 +1 more via @snyk/snyk-hex-plugin (>=1.0.0, <=1.1.4)

@snyk/snyk-hex-plugin NPM version =1.0.0, =0.5.8, =3.0.3-beta.1, =1.520.0, =1.684.0 Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKSNYKHEXPLUGIN-3039680...

ReDoS issue in dparse

Impact dparse versions prior to 0.5.1 contain a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. All users parsing index server URLs with dparse are impacted by this vulnerability. Patches The Patch is applied in the 0.5.2 version, all users are recommended to...

GHSA-8FG9-P83M-X5PQ ReDoS issue in dparse

Impact dparse versions prior to 0.5.1 contain a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. All users parsing index server URLs with dparse are impacted by this vulnerability. Patches The Patch is applied in the 0.5.2 version, all users are recommended to...

Nextcloud: [nextcloud/server] Moment.js vulnerable to Inefficient Regular Expression Complexity

Describe the bugs: 🐛 moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the preprocessRFC2822 function in from-string.js, when processing a...

CVE-2022-40023

A vulnerability was found in the mako package. Affected versions of this package are vulnerable to Regular expression denial of service ReDoS attacks, affecting system availability...

Oracle Linux 9 : nodejs / and / nodejs-nodemon (ELSA-2022-6595)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6595 advisory. - Rebase to version 16.16.0 Resolves: RHBZ2106290 Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 Tenable has extracted the...

steal Inefficient Regular Expression Complexity vulnerability via string variable

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

CVE-2022-37259

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the string variable in babel.js...

CVE-2022-37259

CVE-2022-37259 affects stealjs/steal version 2.2.4. The root cause is a Regular Expression Denial of Service (ReDoS) flaw exposed via a string variable in babel.js. The CVSS metrics indicate Network attack vector, low attack complexity, no privileges or user interaction, with availability impact ...

ALSA-2022:6595 Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 16.16.0, nodejs-nodemon 2.0.19. BZ2124230, BZ2124233 Security Fixes: nodejs-ini:...

Regular Expression Denial Of Service (ReDoS)

steal is vulnerable to prototype pollution. The vulnerability is possible because of the use of insecure regular expression for input in main.js, causing an application crash...

Regular Expression Denial Of Service (ReDoS)

steal is vulnerable to regular expression denial of service ReDoS attacks. A remote attacker is able to cause a system hang via supplying a maliciously crafted input through source or sourceWithComments variables in main.js...

Input validation

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the input variable in main.js...

CVE-2022-37260

CVE-2022-37260 describes a Regular Expression Denial of Service (ReDoS) in the StealJS module loader, specifically in steal 2.2.4 via the input variable in main.js. The CVSS 3.1 base score is 7.5 (HIGH), with attack vector NETWORK, attack complexity LOW, and no privileges or user interaction requ...

CVE-2022-37260

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the input variable in main.js...

Denial of service

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js...

CVE-2022-37262

CVE-2022-37262 is a ReDoS flaw affecting stealjs (StealJS) 2.2.4, reported via the source and sourceWithComments variables in main.js. Connected sources (Red Hat, Veracode, GHSA, OSV, CVE listings) consistently describe a Regular Expression Denial of Service vulnerability exploitable through craf...

Oracle Linux 8 : ruby:2.7 (ELSA-2022-6447)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6447 advisory. - Fix regular Expression Denial of Service Vulnerability of Date Parsing Methods. Resolves: CVE-2021-41817 - Fix cookie prefix spoofing in...