8879 matches found
CVE-2019-13225
Oniguruma 6.9.2 contains a NULL pointer dereference in match_at() (CVE-2019-13225) that can lead to denial of service when a crafted regular expression is used. Multiple connected advisories (AlmaLinux, Fedora, Amazon Linux, Astra Linux) report the vulnerability and list updates/patches for onigu...
CVE-2019-13225
A NULL Pointer Dereference in matchat in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust...
UBUNTU-CVE-2019-13224
A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...
Regular Expression Denial Of Service (ReDoS)
marked is vulnerable to regular expression denial of service DoS. The attack is possible because it does not use efficient link tags in regular expression, thereby leading to a high CPU usage if an attacker parses an input link with nested parenthesis containing a large number of link tokens to t...
Regular Expression Denial Of Service (ReDoS)
marked is vulnerable to regular expression denial of service ReDoS. A mishandling of the backtick character causes the system to consume a large amount of resource to parse a link text containing the backtick character...
CVE-2018-14733
The Odoo Community Association OCA dbfilterfromheader module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS regular expression denial of service under certain circumstances...
CVE-2018-14733
The Odoo Community Association OCA dbfilterfromheader module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS regular expression denial of service under certain circumstances...
CVE-2018-14733
The Odoo Community Association OCA dbfilterfromheader module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS regular expression denial of service under certain circumstances...
oniguruma -- multiple vulnerabilities
A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...
Prototype Pollution
Overview deeply is an a toolkit for deep structure manipulations, provides deep merge/clone functionality out of the box, and exposes hooks and custom adapters for more control and greater flexibility. Affected versions of this package are vulnerable to Prototype Pollution. The function assign-de...
GHSA-QX4V-6GC5-F2VV Regular Expression Denial of Service
A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop...
Regular Expression Denial of Service
A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop...
Regular Expression Denial Of Service (ReDoS)
useragent is vulnerable to regular expression denial of service ReDoS. The attacker can edit the useragent header to include a long useragent string containing long numbers or letters exhausting the CPU via an event loop and eventually crashing the server...
[SECURITY] Fedora 30 Update: mutt-1.12.0-1.fc30
Mutt is a small but very powerful text-based MIME mail client. Mutt is highly configurable, and is well suited to the mail power user with advanced features like key bindings, keyboard macros, mail threading, regular expression searches and a powerful pattern matching language for selecting group...
Prototype Pollution
Overview set-value is a package that creates nested values and any intermediaries using dot notation 'a.b.c' paths. Affected versions of this package are vulnerable to Prototype Pollution. The function set-value could be tricked into adding or modifying properties of Object.prototype using any of...
Prototype Pollution
Overview mixin-deep is a package that deeply mixes the properties of objects into the first object. Affected versions of this package are vulnerable to Prototype Pollution. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...
Rejetto HTTP File Server Remote Code Execution (CVE-2014-6287)
A remote code execution vulnerability exists in Rejetto HTTP File Server. This vulnerability is due to a regular expression that fails to handle null bytes. A remote unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to a target server...
Regular Expression Denial of Service in underscore.string
Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service ReDoS. The function unescapeHTML is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs. Recommendati...
Artifex Software An unspecified vulnerability exists in Artifex MuJS.
Artifex Software Artifex MuJS is a lightweight JavaScript interpreter from Artifex Software that is used to embed into other software to provide script execution capabilities. A security vulnerability exists in Artifex MuJS version 1.0.5, which stems from a regcompx in the regexp.c file that does...