EulerOS 2.0 SP5 : python (EulerOS-SA-2020-1321)

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular...

Prototype Pollution

Overview querymen is a Querystring parser middleware for MongoDB, Express and Nodejs. Affected versions of this package are vulnerable to Prototype Pollution. The parameters of exported function handlertype, name, fn can be controlled by users without any sanitization. This could be abused for...

WAGO PFC100 and PFC200 Information Disclosure Vulnerability

The WAGO PFC 200 and WAGO PFC 100 are both programmable logic controllers PLCs from WAGO Germany. A security vulnerability exists in the Web-Based Management authentication feature in the WAGO PFC200 versions 03.00.3912 and 03.01.0713 and the WAGO PFC100 version 03.00.3912. The vulnerability can ...

CVE-2019-5134

An exploitable regular expression without anchors vulnerability exists in the Web-Based Management WBM authentication functionality of WAGO PFC200 versions 03.00.3912 and 03.01.0713, and WAGO PFC100 version 03.00.3912. A specially crafted authentication request can bypass regular expression...

Design/Logic Flaw

An exploitable regular expression without anchors vulnerability exists in the Web-Based Management WBM authentication functionality of WAGO PFC200 versions 03.00.3912 and 03.01.0713, and WAGO PFC100 version 03.00.3912. A specially crafted authentication request can bypass regular expression...

CVE-2019-5134

An exploitable regular expression without anchors vulnerability exists in the Web-Based Management WBM authentication functionality of WAGO PFC200 versions 03.00.3912 and 03.01.0713, and WAGO PFC100 version 03.00.3912. A specially crafted authentication request can bypass regular expression...

CVE-2019-5134

The CVE-2019-5134 issue affects WAGO PFC100/PFC200 Web-Based Management, where an exploitable regular-expression without anchors in the PasswordCorrect() path allows bypass of authentication filters. A crafted request can trigger a timing/disclosure vulnerability that may reveal or help reveal pa...

Arbitrary Code Execution

Overview fun-map is a functional utilities for pretending that JS objects are Clojure string maps. Affected versions of this package are vulnerable to Arbitrary Code Execution. The injection point is located in line 26 in the index file class.js; the members argument of the create function can be...

WAGO PFC100/200 Web-Based Management (WBM) Authentication Regex Information Disclosure Vulnerability

Summary An exploitable regular expression without anchors vulnerability exists in the Web-Based Management WBM authentication functionality of WAGO PFC100/200 controllers. A specially crafted authentication request can bypass regular expression filters, resulting in sensitive information...

Information Disclosure

parse-server is vulnerable to information disclosure. An insecure regular expression parsing of the sessionToken and token$regex variables allows an attacker to discover and retrieve valid accounts, or verify and reset another user's account...

Prototype Pollution

Overview vega-util is a JavaScript utilities package for Vega. Affected versions of this package are vulnerable to Prototype Pollution. The vega.mergeConfig method within vega-util could be tricked into adding or modifying properties of Object.prototype. PoC by Snyk var util = require'vega-util'...

SUSE-SU-2020:0557-1 Security update for python36

This update for python36 fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issue...

OPENSUSE-SU-2020:0274-1 Security update for python3

This update for python3 fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issue...

SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0510-1)

This update for python fixes the following issues : Security issues fixed : CVE-2019-9674: Improved the documentation, warning about dangers of zip-bombs bsc1162825. CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Note that Tenable...

Design/Logic Flaw

Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices and possibly other products allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly...

PT-2020-18339 · Uap · Uap-Core

Name of the Vulnerable Software and Affected Versions: uap-core versions prior to 0.7.3 Description: The issue allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. This is due to some regexes being vulnerable to...

Prototype Pollution

Overview undefsafe is a Simple function for retrieving deep object properties without getting "Cannot read property 'X' of undefined". Affected versions of this package are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype...

Prototype Pollution

Overview component-flatten is a module that flattens a resolved component tree. Note: This package is deprecated. Affected versions of this package are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Prototype Pollution

Overview dot-object is a module that makes it possible to transform javascript objects using dot notation. Affected versions of this package are vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC ...

Python 2.7.x <= 2.7.17, 3.5 <= 3.5.9, 3.6.x <= 3.6.10, 3.7.x <= 3.7.6, 3.8.x <= 3.8.1 Regular Expression Denial of Service (ReDoS) Vulnerability - Windows

Python is prone to a Regular Expression Denial of Service ReDoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...