PT-2022-14214 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.10.4 GitLab CE/EE versions 15.0 through 15.0.3 GitLab CE/EE versions 15.1 through 15.1.0 Description: A Regular Expression Denial of Service issue allows an attacker to make a GitLab instance inaccessibl...

scss-tokenizer 安全漏洞

scss-tokenizer is Sass Tools open source a Sass SCSS syntax of the splitter . scss-tokenizer has a security vulnerability , the vulnerability stems from the use of insecure regular expressions , all versions of the package scss-tokenizer are susceptible to regular expression denial of service ReD...

PT-2022-17493 · Unknown · Scss-Tokenizer

Name of the Vulnerable Software and Affected Versions: scss-tokenizer versions prior to 0.4.3 Description: The issue is related to a Regular Expression Denial of Service ReDoS in the scss-tokenizer package. This occurs via the loadAnnotation function due to the usage of insecure regex...

that-value Regular Expression Denial of Service (ReDOS) Vulnerability

that-value is a multilingual platform validator package by the individual developer Paweł Stefański, Poland. A Regular Expression Denial of Service ReDOS vulnerability exists in that-value version v0.1.3, which can be exploited by an attacker to cause a denial of service when validating a crafted...

PT-2022-7237 · Unknown · Jquery-Validation

Name of the Vulnerable Software and Affected Versions: jquery-validation versions prior to 1.19.5 Description: The issue is related to the incorrect handling of regular expressions in the url2 method of the jQuery Validation Plugin, which can lead to a denial of service when an attacker supplies...

golang: regexp: stack exhaustion via a deeply nested expression

A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...

golang: regexp: stack exhaustion via a deeply nested expression

A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...

GHSA-4CF5-XMHP-3XJ7 Improper Authorization in Apache Shiro

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

Apache Tika Denial of Service Vulnerability (CNVD-2022-51053)

Apache Tika is a collection of content extraction tools from the Apache Foundation that integrates POI an open source library that uses Java programs to provide read and write functionality for Microsoft Office format documents, Pdfbox a pure Java library for reading and creating PDF documents an...

repo-git-downloader denial-of-service vulnerability

repo-git-downloader is a tool for downloading git repositories. repo-git-downloader v0.1.1 contains a denial of service vulnerability, which stems from the presence of improper regular expressions and can be exploited by attackers to cause a denial of service DOS attack...

Apache Shiro Authentication Bypass Vulnerability (CNVD-2022-48384)

Apache Shiro is a Java security framework for performing authentication, authorization, encryption, and session management from the Apache Foundation.An authentication bypass vulnerability exists in Apache Shiro, which is caused when the RegexRequestMatcher method of privilege configuration is us...

Inefficient Regular Expression Complexity potentially leads to Denial of Service in

Description Inefficient regular expression complexity of lowercase and uppercase regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeati + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase. The same issue happens with...

The vulnerability of the Intel SGX driver for Linux operating system kernels allows unauthorized users to cause service failures due to uncontrolled resource consumption.

The vulnerability of the Intel SGX driver for Linux operating system kernels is related to an uncontrolled consumption of resources when switching from the EPC segment Enclave Page Cache to regular RAM. Exploiting this vulnerability can allow a hacker to cause a service failure...

Regular Expression Denial Of Service (ReDoS)

split-html-to-chars is vulnerable to regular expression denial of service. The vulnerability exists in Splitter function in index.js because the html inputs are not properly sanitized due to insufficient regular expression complexity applied when splitting html to letters for animation which allo...

Regular Expression Denial Of Service (ReDoS)

regexfn is vulnerable to regular expression denial of service. The vulnerability exists in isEmail function in index.js because the emails are not properly validated with sufficient regular expression complexity which allows an attacker to send crafted invalid emails causing a denial of service...

Apache Shiro 安全漏洞

Apache Shiro is a Java security framework for performing authentication, authorization, encryption, and session management from the Apache Foundation.An authentication bypass vulnerability exists in Apache Shiro, which is caused when the RegexRequestMatcher method of privilege configuration is us...

validate-color Denial of Service Vulnerability (CNVD-2022-66398 )

validate-color is a Norwegian Wallace Sidhrée personal developer for validating HTML colors. A denial of service vulnerability exists in validate-color version v2.1.0, which can be exploited to cause a Regular Expression Denial of Service ReDOS by an attacker who fails to properly handle a crafte...

Stack overflow

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is ...

CVE-2022-31100

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to...

Code injection

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to...