Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. POC var lo = require'lodash'; function buildblank n var ret = "1" for var i = 0; i n; i++ ret += " " return ret + "1"; var s = buildblank50000 var...

Regular Expression Denial of Service (ReDoS)

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. POC var lo = require'lodash'; function buildblank n var...

Regular Expression Denial of Service (ReDoS)

Overview djvalidator is a DjValidator is the jquery plugin for validating web forms, simpler, faster to use and flexible, it does not depend on any UI framework. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS by sending crafted invalid emails - for...

Regular Expression Denial of Service (ReDoS)

Overview express-validators is an Express framework json objectreq validator. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls. POC: var expressValidators = require"express-validators"; var Obj =...

Regular Expression Denial of Service (ReDoS)

Overview trim is a Trim string whitespace Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the trim method. PoC by Liyuan Chen: js var trim = require"trim" function buildattack n var ret = "1" for var i = 0; i n; i++ ret += " " return ret + "1"; v...

CVE-2020-2288

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling...

Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7

Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 Vaadin 7.0.0 through 7.7.21 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. See CWE-400: Uncontrolled Resource Consumption Description...

Regular Expression Denial of Service (ReDoS)

Overview dat.gui is an A lightweight graphical user interface for changing variables in JavaScript. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via specially crafted rgb and rgba values. PoC js var gui = new dat.gui.GUI; var Options = function...

CVE-2020-15598

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial...

Cisco IOS Software Split DNS DoS (cisco-sa-splitdns-SPWqpdGW)

According to its self-reported version, Cisco IOS Software is affected by a denial of service DoS vulnerability as the Split DNS feature's regular expression regex engine may time out when processing the DNS name list configuration. An unauthenticated, remote attacker could cause an affected devi...

CVE-2020-26159

A flaw was found in oniguruma. An attacker, able to supply a regular expression for compilation, may be able to overflow a buffer by one byte in concatoptexactstr in src/regcomp.c . Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red...

Design/Logic Flaw

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of...

CVE-2020-25288

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of...

CVE-2020-25288

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of...

UBUNTU-CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

CVE-2019-20922 affects the Handlebars.js template engine before 4.4.5. The vulnerability stems from an eager RegExp matching approach in the parser, which can be forced into an endless loop by crafted templates, leading to resource exhaustion. Impact is described as denial of service via consumed...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

PT-2020-16066

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.24.3 Description An issue was discovered that allows HTML injection and potentially the execution of arbitrary JavaScript when editing an issue in a project with a custom field that has a crafted regular expression...