CVE-2021-40098

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

PT-2021-22807

Name of the Vulnerable Software and Affected Versions Concrete CMS versions through 8.5.5 Description An issue was discovered in Concrete CMS, allowing Path Traversal leading to Remote Code Execution RCE via an external form by adding a regular expression. Recommendations For versions through...

CVE-2021-3822: Inefficient Regular Expression Complexity

jsoneditor is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3820: Inefficient Regular Expression Complexity

inflect is vulnerable to Inefficient Regular Expression Complexity...

CVE-2021-3828: Inefficient Regular Expression Complexity

nltk is vulnerable to Inefficient Regular Expression Complexity...

PT-2021-22006

Name of the Vulnerable Software and Affected Versions: inflect affected versions not specified Description: The issue concerns Inefficient Regular Expression Complexity. inflect is a customizable inflections library for nodejs. Recommendations: At the moment, there is no information about a newer...

CVE-2021-40098: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression...

Inefficient Regular Expression Complexity in crankyoldgit/irremoteesp8266

✍️ Description The IRremoteESP8266 package is vulnerable to ReDoS regular expression denial of service. An attacker that is able to provide crafted input to the extractsupports function in the file scrapesupporteddevices.py may cause an application to consume an excessive amount of CPU. Below...

Regular Expression Denial Of Service (ReDoS)

leo is vulnerable to regular expression denial of service. An attacker is able to exploit the vulnerability to crash the system by submitting a maliciously crafted string via the plugins/importers/dart.py...

GHSA-M489-XR35-FJXR Regular Expression Denial of Service in millisecond

Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed. Proof of concept var ms = require'millisecond'; var genstr = function len, chr var result = ""; for i=0; i=len; i++ result = result + chr;...

Denial of service

Leo Editor v6.2.1 was discovered to contain a regular expression denial of service ReDoS vulnerability in the component plugins/importers/dart.py...

PYSEC-2021-338

Leo Editor v6.2.1 was discovered to contain a regular expression denial of service ReDoS vulnerability in the component plugins/importers/dart.py...

Inefficient Regular Expression Complexity in cronvel/terminal-kit

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in terminal-kit. It allows cause a denial of service when calling function markupWidth. The ReDoS vulnerability is mainly due to the regex /^^|^./g and can be exploited with the following code. Proof...

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe

A flaw was found in nodejs-path-parse. All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...