4769 matches found
Memory corruption
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups...
CVE-2020-35679
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups...
UBUNTU-CVE-2020-35679
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups...
CVE-2020-35679
OpenSMTPD has two CVEs associated with older releases prior to 6.8.0p1: CVE-2020-35679: In smtpd/table.c, a regfree issue can allow an attacker to trigger a very significant memory leak by sending messages to an instance performing many regex lookups. CVE-2020-35680: In certain configurations, sm...
CVE-2020-35679
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups...
Openbsd Opensmtpd Security Vulnerability
Openbsd Opensmtpd is an RFC 5321-based SMTP server software from the Openbsd organization. A security vulnerability exists in OpenSMTPD versions prior to 6.8.0p1, which stems from the lack of a specific regfree in smtpd/table.c, and can be exploited by an attacker to trigger a "very severe" memor...
Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload
Exploit Title: Wordpress Plugin Contact Form 7 5.3.1 - Unrestricted File Upload Date: 12/20/2020 Exploit Author: Ramón Vila Ferreres @ramonvfer Vendor Homepage: https://contactform7.com Software Link: https://wordpress.org/plugins/contact-form-7/ Version: 5.3.1 and below Tested on: Windows 10 190...
Rocket.Chat: Unread Messages can leak Message IDs
The Meteor Method "unreadMessages" could leak existing Message IDs to unauthorized clients when called with a regular expression. The vulnerability was present in Rocket.Chat versions 3.9.3 and develop...
Ruby on Rails: Regex Injection from request header (Rack::Sendfile, send_file)
I have confirmed that Rack::Sendfile and the Rails sendfile that handles it have a problem handling custom headers for request. It is expected that the X-Sendfile-type and X-Accel-Mapping headers will be sent from nginx, but these headers can also be sent from a user agent such as a browser. This...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
ua-parser-js security vulnerability
ua-parser-js is a JavaScript-based parser for User-Agent strings. It can be used in a browser client-side or node.js server-side environment. Can also be used as a jQuery / Zepto plugin , Bower / Meteor package and RequireJS / AMD module . A security vulnerability exists in ua-parser-js prior to...
Pytest Security Breach
Pytest is a Python language-based testing framework from the Pytest team. Pytest has a security vulnerability in py.path.svnwc that stems from a denial of service via a regular expression in py.path from the python-py svnwc component can be exploited by an attacker who can use the vulnerability t...
C2FO Fast-csv Resource Management Error Vulnerability
C2FO Fast-csv is a Typescript-based code library for parsing and formatting CSV-formatted files from Packwood C2FO. A security vulnerability exists in Fast-csv, which stems from a possible re-dos vulnerability regular expression denial of service when parsing with the ignoreEmpty option...
Js-X-Ray - JavaScript And Node.js Open-Source SAST Scanner (A Static Analysis Of Detecting Most Common Malicious Patterns)
JavaScript AST analysis. This package has been created to export the Node-Secure AST Analysis to enable better code evolution and allow better access to developers and researchers. The goal is to quickly identify dangerous code and patterns for developers and Security researchers. Interpreting th...
Security update for neomutt (moderate)
openSUSE Security Update: Security update for neomutt Announcement ID: openSUSE-SU-2020:2157-1 Rating: moderate References: 1172906 1172935 1173197 1179035 1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP1 An...
oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
An out-of-bounds read vulnerability was found in Oniguruma in the way it handled regular expression quantifiers. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, could possibly crash the application,...
Ruby on Rails: HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.
When a site is configured to use the .tkte.ch leading dot short form for domain name, ex: ruby config.hosts You are being redirected. Where the controller is simply: ruby class RedirectController ApplicationController def main redirectto action: 'main' end end The host header poisoning was report...
serenity:FuzzRegexPosixExtended: Heap-buffer-overflow in regex::Lexer::back
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5077400093982720 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzRegexPosixExtended Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...
Atlassian Fisheye Crucible Denial of Service Vulnerability
Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A denial of service vulnerability exists in Atlassian Fisheye/Crucible, which can be exploited by an...