8879 matches found
Regular Expression Denial of Service in bleach
All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...
Design/Logic Flaw
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on th...
Cross-Site Scripting in jquery
Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as selectors wh...
Kamailio 5.4.0 Header Smuggling Exploit
Kamailio version 5.4.0 is vulnerable to header smuggling via a bypass of removehf. Kamailio vulnerable to header smuggling possible due to bypass of removehf - Fixed versions: Kamailio v5.4.0 - Enable Security Advisory: - Tested vulnerable versions: 5.3.5 and earlier - Timeline: - Report date &...
GHSA-M45F-4828-5CV5 Regular Expression Denial of Service in highcharts
Withdrawn: Duplicate of GHSA-xmc8-cjfr-phx3...
GHSA-4X7C-CX64-49W8 Regular Expression Denial of Service in is-my-json-valid
Withdrawn: Duplicate of GHSA-f522-ffg8-j8r6...
Regular Expression Denial of Service in is-my-json-valid
Withdrawn: Duplicate of GHSA-f522-ffg8-j8r6...
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled and \X or \R has more than one fixed quantifier a related issue to CVE-2019-20454.
...
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
...
In the GNU C Library (aka glibc or libc6) through 2.29 check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
...
USN-4460-1: Oniguruma vulnerabilities
It was discovered that Oniguruma incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified impact. CVE-2019-16163, CVE-2019-19012, CVE-2019-19204, CVE-2019-19246...
The moment.js version 2.9.0 is vulnerable to regular expression denial of service
h3. Issue Summary Bamboo uses moment.js version 2.9.0 which is vulnerable to regular expression denial of service. For additional details see https://github.com/moment/moment/issues/2936 and https://www.npmjs.com/advisories/55. h3. Suggested Solution Upgrade moment.js to version = 2.11.2...
Regular Express Denial Of Service (ReDoS)
wappalyzer is vulnerable to denial of service DoS. The vulnerability exists as it uses a regular expression that does not restrict the amount of 0-9., allowing a long string to exhaust memory...
RHEL 8 : java-1.8.0-openjdk (RHSA-2020:1515)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1515 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...
Integer Overflow
Perl has an integer overflow related to mishandling of a "PLregkindOPn == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection...
Denial Of Service (DoS)
perl is vulnerable to denial of service DoS. The vulnerability exists through a buffer overflow via a crafted regular expression because of recursive Sstudychunk calls...
Amazon Linux 2 : python, python3 (ALAS-2020-1471)
The version of python installed on the remote host is prior to 2.7.18-1. The version of python3 installed on the remote host is prior to 3.7.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1471 advisory. 2023-10-25: CVE-2022-48560 was added to this...
Medium: python, python3
Issue Overview: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic...
Regular Express Denial Of Service (ReDoS)
is-my-json-valid is vulnerable to regular expression denial of service ReDoS. The vulnerability exists as it does not impose a max length on the string to be tested against the regular expression, and uses a regular expression that evaluates strings at exponential times...
EulerOS 2.0 SP8 : perl (EulerOS-SA-2020-1820)
According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Perl before 5.30.3 has an integer overflow related to mishandling of a 'PLregkindOPn == NOTHING' situation. A crafted regular expression could lea...