Regular Expression Denial Of Service (ReDoS)

devise-security is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability exists due to the usage of a vulnerable regular expression that allows a malicious string to cause a ReDoS attack when parsed...

Regular Expression Denial Of Service (ReDoS)

lodash is vulnerable to Regular Expression Denial of Service ReDoS attacks. The library uses a regular expression that does not properly handle processing a large amount of characters, allowing a malicious user to cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

is-url is vulenrable to regular expression denial of service ReDoS. An attacker is able to create a denial of service condition on the server via a specially crafted URL...

Security Bulletin: Vulnerabilities in OpenSSL and ReDoS vulnerability in semver module affect IBM® SDK for Node.js™ in IBM Bluemix (CVE-2016-2107, CVE-2016-2105, CVE-2015-8855)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. The "semver" module is vulnerable to regular expression denial of service ReDoS when extremely long version strings...

Security Bulletin: Two ReDoS vulnerabilities in modules included in the Node.js npm tool affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux

Summary Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i RPG and COBOL + Modernization Tools, Java and EGL editions, and Rational Developer for AIX and Linux. Two ReDoS vulnerabilities in modules included in the Node.js n...

autotest-engine (>=1.0.0, <=1.3.9), grunt-newman (1.0.7) +11 more potentially affected by CVE-2016-2515 via hawk (>=3.1.0, <=3.1.2)

hawk NPM version =3.1.0, =1.0.0, =1.0.0, =0.1.6, =1.2.25, =0.0.1, =0.0.6-prealpha.1, =1.0.0, =4.0.3, =1.0.0, =2.1.2, =2.2.0 Source cves: CVE-2016-2515 Source advisory: OSV:GHSA-JCPV-G9RR-QXRC...

10er10 (0.23.0), 10tcl (>=0.0.1, <=0.0.10) +11449 more potentially affected by CVE-2017-16119 via fresh (>=0.0.1, <=0.5.1)

fresh NPM version =0.0.1, =0.0.1, =1.0.1, =1.0.3, =1.0.2, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.0.1, =0.0.5 - 4design 0.0.1 and more Source cves: CVE-2017-16119 Source advisory: OSV:GHSA-9QJ9-36JM-PRPV...

0xble (>=7.1.0, <=13.3.1), 3dguysplayer (1.0.0) +1587 more potentially affected by CVE-2017-16116 via string (>=3.0.0, <=3.3.3)

string NPM version =3.0.0, =7.1.0, =1.0.0, =0.0.5, =0.2.2, =1.0.1, =1.0.3, =0.3.4, =0.2.1, =0.7.6-alpha.1, =1.0.0, =1.0.0, =1.32.7 and more Source cves: CVE-2017-16116 Source advisory: OSV:GHSA-G36H-6R4F-3MQP...

192.168.0.172 (4.6.1), 3loc (>=0.2.0, <=0.4.0) +3499 more potentially affected by CVE-2017-15010 via tough-cookie (>=2.0.0, <=2.3.2)

tough-cookie NPM version =2.0.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =2.1.0, =0.0.0, =0.1.0-alpha.1, =1.0.1, =0.11.0-atomist-update-branch-master-1541106195325.20181102202646, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-2018081515595...

method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

Affected versions of method-override are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the X-HTTP-Method-Override header. Recommendation Update to version 2.3.10 or later...

ReDoS via long UserAgent header in useragent

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed. Proof of Concept js var useragent = require'useragent'; var badUserAgent = 'MSIE 0.0'+Array900000.join'0'+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agen...

ReDoS via long UserAgent header in ua-parser

Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header. Recommendation No patch is currently available for this vulnerability. The best mitigation is currently to avoid using this package, using a different,...

Regular Expression Denial Of Service (ReDoS)

validator is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a base64 string that when validated by the application will cause a ReDoS attack...

Regular Expression Denial Of Service (ReDoS)

validator is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a long URI to the isDataURI function to cause a ReDoS attack...

Regular Expression Denial Of Service (ReDoS)

jasmine-core is vulnerable to a Regular Expression Denial of Service ReDoS attack. The regular expression ^\sfunction\s\w\s\ is used to obtain the function name from the JS toString output of a function, which can result in a matching time of approximately 10 seconds for data that is 64K...

CVE-2018-13863

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...

CVE-2018-13863

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...

Design/Logic Flaw

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...

Security Bulletin: Two ReDoS vulnerabilities in modules included in the Node.js npm tool

Summary Two ReDoS vulnerabilities in modules included in the Node.js npm tool shipped by IBM Rational Application Developer for WebSphere Software. Vulnerability Details CVEID: CVE-2016-2515 DESCRIPTION: Node.JS hawk is vulnerable to a denial of service, caused by an error in the regular expressi...

Regular Expression Denial Of Service (ReDoS)

no-case is vulnerable to regular expression denial of service ReDoS attacks. The library does not properly sanitize user input strings, causing slowdown when matching strings that can lead to a ReDoS...