GitLab: All functions that allow users to specify color code are vulnerable to ReDoS

Summary: Invalid color code leads to DoS. Description: GitLab has some functions that allow users to specify color code. e.g.: Labels/Broadcast Messages All those functions are vulnerable to ReDoS. It seems that there is a problem with the regex in app\validators\colorvalidator.rb to validate a...

Arjun v1.3 - HTTP Parameter Discovery Suite

Features Multi-threading 4 modes of detection A typical scan takes 30 seconds Regex powered heuristic scanning Huge list of 25,980 parameter names Makes just 30-35 requests to the target Usage Note: Arjun doesn't work with python 3.4 Discover parameters To find GET parameters, you can simply do:...

Cuteit v0.2.1 - IP Obfuscator Made To Make A Malicious Ip A Bit Cuter

IP obfuscator made to make a malicious ip a bit cuter A simple python tool to help you to social engineer, bypass whitelisting firewalls, potentially break regex rules for command line logging looking for IP addresses and obfuscate cleartext strings to C2 locations within the payload. All of that...

The vulnerability of the Perl_my_setenv function in the Perl programming language, related to errors in processing regular expressions, allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the Perlmysetenv function in “util.c” of the Perl programming language is related to errors in processing regular expressions. This leads to copying data into a buffer without checking the size of the input data, resulting in integer overflow. Exploiting this vulnerability ca...

The vulnerability of the Perl programming language interpreter, related to errors in processing regular expressions, allows attackers to execute arbitrary code.

The vulnerability of the Perl programming language interpreter is related to errors in the processing of regular expressions, which can lead to the execution of the write operation beyond the buffer boundaries when the buffer is overflowing. Exploiting this vulnerability allows a remote attacker ...

DEBIAN-CVE-2019-9192

In the GNU C Library aka glibc or libc6 through 2.29, checkdstlimitscalcpos1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '|\1\1' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs...

UBUNTU-CVE-2009-5155

In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service assertion failure and application exit or trigger an incorrect result by attempting a regular-expression match...

UBUNTU-CVE-2019-9169

In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match...

AZL-44787 CVE-2009-5155 affecting package metis 5.1.0.3-7

In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service assertion failure and application exit or trigger an incorrect result by attempting a regular-expression match...

DEBIAN-CVE-2018-20796

In the GNU C Library aka glibc or libc6 through 2.29, checkdstlimitscalcpos1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '\227|\1\1|t1|\\2537+' in grep...

DEBIAN-CVE-2019-9169

In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match...

PT-2019-19426

Name of the Vulnerable Software and Affected Versions GNU C Library aka glibc or libc6 versions prior to 2.30 Description The issue is related to Uncontrolled Recursion in the check dst limits calc pos 1 function in posix/regexec.c. This can be demonstrated by using a crafted pattern '|11' in gre...

PT-2019-5586

Name of the Vulnerable Software and Affected Versions GNU C Library aka glibc or libc6 versions prior to 2.30 Description The issue is related to uncontrolled recursion in the GNU C Library when processing regular expressions. This can lead to a denial of service. The problem arises when the...

CVE-2019-9023

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in...

1tp (>=0.0.1, <=0.11.2), @chengkang/wildfire (>=0.0.1, <=0.0.4) +262 more potentially affected by CVE-2016-10536 via engine.io-client (>=1.6.4, <=1.6.8)

engine.io-client NPM version =1.6.4, =0.0.1, =0.0.1, =1.8.4, =1.0.0, =1.0.30, =0.1.0, =2.0.0-beta.1, =1.0.0, =0.0.1, =0.3.2, =0.3.0, =2.0.1, =1.7.0, =1.7.1 and more Source cves: CVE-2016-10536 Source advisory: OSV:GHSA-4R4M-HJWJ-43P8...

CVE-2019-6986

SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service ReDoS, as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request...

Sql injection

SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service ReDoS, as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request...

perl: Integer overflow leading to buffer overflow in Perl_my_setenv()

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations...

[SECURITY] Fedora 28 Update: perl-Email-Address-1.912-1.fc28

This class implements a regex-based RFC 2822 parser that locates email addresses in strings and returns a list of Email::Address objects found. Alternatively you may construct objects manually. The goal of this software is to be correct, and very very fast...

Denial Of Service (DoS)

file is vulnerable to denial of service DoS attacks. The vulnerability exists as file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking duri...