validate.js 安全漏洞

validate.js is a declarative validation library written in javascript by the individual developer Nicklas Ansman. A security vulnerability exists in validate.js version 0.13.1 and prior versions, which stems from the presence of a regular expression denial of service vulnerability...

useragent 安全漏洞

useragent is a high-performance user agent parser for Node.js by the individual developer Arnout Kazemier. A security vulnerability exists in useragent that stems from a regular expression denial of service vulnerability...

PT-2024-10798

Name of the Vulnerable Software and Affected Versions Validate.js versions 0.13.1 and prior Description Validate.js provides a declarative way of validating javascript objects. The issue concerns one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. No...

CommonRegexJS 安全漏洞

CommonRegexJS is a CommonRegex port of JavaScript by the individual developer Talysson de Oliveira Cassiano. A security vulnerability exists in CommonRegexJS that stems from the inclusion of one or more regular expressions that are vulnerable to regular expression denial of service ReDoS attacks...

PT-2024-10795 · Unknown · Commonregexjs

Name of the Vulnerable Software and Affected Versions: CommonRegexJS versions all available versions Description: The issue concerns Regular Expression Denial of Service ReDoS due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in async

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of async. Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of service, caused by the ReDoS Regular Expression Denial of Service while parsing function in autoinject functio...

Permissive Regular Expression

github.com/facebookincubator/tacquito is vulnerable to Permissive Regular Expression. The vulnerability is due to permissive regex matching where the system matches sub-strings instead of the entire string for authorized commands and arguments. This could allow unauthorized commands to be execute...

Regular Expression Denial Of Service (ReDoS)

Action Mailer is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the blockformat helper taking an unexpected amount of time when processing carefully crafted text, potentially resulting in a DoS condition...

Regular Expression Denial Of Service (ReDoS)

Action Text is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the way the plaintextforblockquotenode helper processes specific text inputs, leading to a scenario where the processing time can grow unexpectedly long, ultimately resulting in a Denial of Servic...

Regular Expression Denial Of Service (ReDoS)

Action Pack is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to inefficient regular expression handling in Action Controller's HTTP Token authentication, which can be triggered by a carefully crafted header, causing significant delays in header parsing...

Regular Expression Denial Of Service (ReDoS)

Action Pack is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the improper handling of regular expressions in the query parameter filtering routines, allowing attackers to craft input that significantly delays processing and potentially leads to a Denial of...

Regular Expression Denial of Service (ReDoS)

Overview @eslint/plugin-kit is an Utilities for building ESLint plugins. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. PoC javascript const argument =...

Important: Red Hat Security Advisory: Network Observability 1.7.0 for OpenShift

Network Observability 1.7 for Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2024-10202

Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...

CVE-2024-10202

The CVE-2024-10202 entry concerns the Wellchoose Administrative Management System with an OS Command Injection vulnerability. The available sources state that remote attackers with regular privileges can inject and execute arbitrary OS commands. The issue is labeled high severity (CVSS 3.1: AV:N/...

CVE-2024-10201 Wellchoose Administrative Management System - Arbitrary File Upload

Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells...

Duplicate Advisory: Permissive Regular Expression in tacquito

Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-45296)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45296 advisory. - path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a...

Taquito 安全漏洞

Taquito is ECAD open source a fast and lightweight TypeScript library . Taquito suffers from a command execution vulnerability that stems from not properly executing regular expression matches for authorized commands and parameters, which can be exploited by an attacker to execute unauthorized...