10355 matches found
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in async
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of async. Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of service, caused by the ReDoS Regular Expression Denial of Service while parsing function in autoinject functio...
Permissive Regular Expression
github.com/facebookincubator/tacquito is vulnerable to Permissive Regular Expression. The vulnerability is due to permissive regex matching where the system matches sub-strings instead of the entire string for authorized commands and arguments. This could allow unauthorized commands to be execute...
Regular Expression Denial Of Service (ReDoS)
Action Mailer is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the blockformat helper taking an unexpected amount of time when processing carefully crafted text, potentially resulting in a DoS condition...
Regular Expression Denial Of Service (ReDoS)
Action Text is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the way the plaintextforblockquotenode helper processes specific text inputs, leading to a scenario where the processing time can grow unexpectedly long, ultimately resulting in a Denial of Servic...
Regular Expression Denial Of Service (ReDoS)
Action Pack is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to inefficient regular expression handling in Action Controller's HTTP Token authentication, which can be triggered by a carefully crafted header, causing significant delays in header parsing...
Regular Expression Denial Of Service (ReDoS)
Action Pack is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the improper handling of regular expressions in the query parameter filtering routines, allowing attackers to craft input that significantly delays processing and potentially leads to a Denial of...
Regular Expression Denial of Service (ReDoS)
Overview @eslint/plugin-kit is an Utilities for building ESLint plugins. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. PoC javascript const argument =...
Important: Red Hat Security Advisory: Network Observability 1.7.0 for OpenShift
Network Observability 1.7 for Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
CVE-2024-10202
Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...
CVE-2024-10202
The CVE-2024-10202 entry concerns the Wellchoose Administrative Management System with an OS Command Injection vulnerability. The available sources state that remote attackers with regular privileges can inject and execute arbitrary OS commands. The issue is labeled high severity (CVSS 3.1: AV:N/...
CVE-2024-10201 Wellchoose Administrative Management System - Arbitrary File Upload
Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells...
CVE-2024-10202: Improper Neutralization of Special Elements used in an OS Command
Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...
Duplicate Advisory: Permissive Regular Expression in tacquito
Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That...
PT-2024-33511 · Tacquito · Tacquito
Name of the Vulnerable Software and Affected Versions: Tacquito versions prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 Description: The issue concerns the improper performance of regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to...
ROS-20241017-08
Vulnerability in the 'http.cookies' standard library module of the Python programming language interpreter CPython is related to inefficient regular expression complexity. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
CBL Mariner 2.0 Security Update: reaper (CVE-2024-45296)
The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45296 advisory. - path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a...
Taquito 安全漏洞
Taquito is ECAD open source a fast and lightweight TypeScript library . Taquito suffers from a command execution vulnerability that stems from not properly executing regular expression matches for authorized commands and parameters, which can be exploited by an attacker to execute unauthorized...
