Security Bulletin: Vulnerability in pytest-dev py affects IBM watsonx.data

Summary pytest-dev py is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw by the InfoSvnCommand argument. By sending a specially-crafted regex info data, a remote attacker could exploit this vulnerability to cause a denial of service condition. This c...

Security Bulletin: Vulnerability in Perl affects IBM watsonx.data

Summary Perl is vulnerable to buffer overflow issues. CVE-2020-10543: This vulnerability is identified in 32 bit, but watsonx.data is deployd in 64 bit platform. Hence watsonx.data is not affected. CVE-2020-10878, CVE-2020-12723: If user supplied string and it is used in a regex in our code, this...

CVE-2022-25769 Improper regex in htaccess file

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path...

CVE-2022-25769 Improper regex in htaccess file

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path...

CVE-2024-6641

The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated...

WordPress plugin WP Hardening 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

The vulnerability of the configobj program for reading and writing INI files lies in the use of a regular expression c, which has an inefficient computational cost. This allows attackers to trigger a service failure.

The vulnerability of the configobj program for reading and writing INI files is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

path-to-regexp outputs backtracking regular expressions

Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period .. For example, /:a-:b. Patches For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. These versions add backtrack protection...

AZL-49161 CVE-2024-45296 affecting package nodejs-nodemon 2.0.3-5

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

UBUNTU-CVE-2024-45296

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

CVE-2024-45296

The Jira Service Management Data Center/Server DoS issue (CVE-2024-45296) stems from the path-to-regexp dependency, which can generate pathological regular expressions causing DoS on the main thread. Affected: Jira Service Management DC/Server versions 10.2.0–10.5.0. CVSS 3.1 vector: AV:N/AC:L/PR...

Path-to-RegExp 安全漏洞

Path-to-RegExp is an open source tool from pillarjs. It is used to convert path strings to regular expressions. A security vulnerability exists in Path-to-RegExp, which stems from the fact that backtracking a regular expression could lead to a denial of service...

Moderate: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.1.2

Red Hat Trusted Profile Analyzer 1.1.2 release Red Hat Product Security has rated this update as having a security impact of Moderate Red Hat Trusted Profile Analyzer 1.1.2 Security Fixes: nodejs-async: Regular expression denial of service while parsing function in autoinject CVE-2024-39249 For...

AZL-48585 CVE-2024-6232 affecting package python3 for versions less than 3.9.19-5

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

PT-2024-15266 · Secure Systems Engineering · Secure Systems Engineering Connaisseur

Name of the Vulnerable Software and Affected Versions: Secure Systems Engineering Connaisseur versions up to 3.3.0 Description: A vulnerability has been found in Secure Systems Engineering Connaisseur, affecting unknown code of the file connaisseur/res/targets schema.json of the component...

Apache Tapestry HMAC secret key leak

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Tapestry HMAC secret key leak', 'Description' = %q This exploit finds the HMAC secret key used in Java serialization by Apache Tapestry...

Metasploit HTTP(S) handler Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Metasploit HTTPS handler DoS', 'Description' = %q This module exploits the Metasploit HTTPS handler by sending a specially crafted HTTP request...

PT-2024-34153 · Symfony +5 · Symfony/Validator +5

Name of the Vulnerable Software and Affected Versions: symfony/validator versions 5.4.43, 6.4.11, and 7.1.4 Description: The symfony/validator module in the Symphony PHP framework is vulnerable to a regex bypass issue. It is possible to trick a Validator configured with a regular expression using...

BIT-GITLAB-2024-2800 Uncontrolled Resource Consumption in GitLab

ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to Node.js semver ( CVE-2022-25883 )

Summary Node.js semver is used by IBM Cloud Pak for Data as part of the platform. CVE-2022-25883. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the new Range...