Atlassian Fisheye 和 Crucible 安全漏洞

Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A denial of service vulnerability exists in Atlassian Fisheye/Crucible, which can be exploited by an...

Regular Expression Denial of Service (ReDoS)

Overview semver-regex is a Regular expression for matching semver versions Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper usage of regex in the semverRegex function. PoC js // import of the vulnerable library const semverRegex =...

CVE-2020-13349

An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are =8.12, =13.4, =13.5, 13.5.2...

Design/Logic Flaw

An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are =8.12, =13.4, =13.5, 13.5.2...

CVE-2020-13349

An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are =8.12, =13.4, =13.5, 13.5.2...

CVE-2020-13349

Removed by vendor...

Regular Expression Denial Of Service (ReDoS)

liquid is vulnerable to regular expression denial of service. A Catastrophic Backtracking vulnerability allows an attacker crash the application by providing a malicious value to the RANGESREGEX regular expression...

Oracle Linux 8 : python3 (ELSA-2020-4433)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4433 advisory. - Avoid infinite loop when reading specially crafted TAR files CVE-2019-20907 Resolves: rhbz1856481 - Resolve hash collisions for Pv4Interface and...

Design/Logic Flaw

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

CVE-2020-7767 Regular Expression Denial of Service (ReDoS)

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

CDFMonitor

NOTE : CDFMonitor is now deprecated, to capture trace as service use - https://support.citrix.com/article/CTX677255/citrix-cdfcontrol-as-service Please note: You can download the required file from the Citrix downloads website by visiting the following...

Regular Expression Denial Of Service (ReDoS)

@absolunet/kafe is vulnerable to regular expression denial of service. An insecure regular expression that is used to parsed email address allows an attacker to crash the application using a malicious email address...

Security Bulletin: App Connect Enterprise Certified Container Designer instances may be vulnerable to CVE-2020-7760

Summary Some flow editor dialogs in a Designer instance App Connect Enterprise Certified Container may be vulnerable to a regular expression denial of service flaw that could make that Designer instance unresponsive. Vulnerability Details CVEID: CVE-2020-7760 DESCRIPTION: Node.js codemirror modul...

CVE-2020-7761 Regular Expression Denial of Service (ReDoS)

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails...

squid: Improper access restriction in url_regex may lead to security bypass

A flaw was found in squid. The Cache Manager for Squid has rules that, by default, block access to anyone other than the maintainer. An attacker, with the ability to send a properly crafted URL, can bypass the urlregex check and gain access to the blocked resource. The highest threat from this...

python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

An uncontrolled resource consumption vulnerability was discovered in python in the class AbstractBasicAuthHandler, due to the kind of regular expression used while handling an authentication request in the httperrorauthreqed method. Client applications that use, directly or indirectly,...

ALSA-2020:4539 Moderate: pcre2 security and enhancement update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...

RLSA-2020:4539 Moderate: pcre2 security and enhancement update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...

Moderate: pcre2 security and enhancement update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 For...

EulerOS 2.0 SP2 : ruby (EulerOS-SA-2020-2395)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause...