CVE-2024-47532 RestrictedPython information leakage via `AttributeError.obj` and the `string` module

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application...

CVE-2024-47532 RestrictedPython information leakage via `AttributeError.obj` and the `string` module

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application...

PT-2024-32646

Name of the Vulnerable Software and Affected Versions RestrictedPython versions prior to 7.3 Description A user can gain access to protected information indirectly via AttributeError.obj and the string module. This issue allows unauthorized access to potentially sensitive information...

CVE-2024-47532: Exposure of Sensitive Information to an Unauthorized Actor

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application...

Remote Code Execution (RCE)

accesscontrol is vulnerable to remote code execution. Having full access to Python's string module allows users with admin-level Zope "Manager" role to access to the class Formatter, which can be overridden and extended within Script Python in a way that provides access to other unsafe Python...

PYSEC-2021-875

The module AccessControl defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of Script Python objects. The policies defined in AccessControl severely restrict access to...

CVE-2021-32807

The module "AccessControl" defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of "Script Python" objects. The policies defined in "AccessControl" severely restrict...

PT-2021-28364

Name of the Vulnerable Software and Affected Versions: AccessControl versions 4.0 through 4.2 AccessControl versions 5.0 through 5.1 Description: The issue concerns the AccessControl module in Zope applications, which defines security policies for Python code. It allows restricted access to Pytho...

CVE-2021-32807: Improperly Controlled Modification of Dynamically-Determined Object Attributes

The module AccessControl defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of Script Python objects. The policies defined in AccessControl severely restrict access to...

CVE-2017-16116

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

string module denial of service vulnerability

The string module is a lightweight JavaScript library that provides additional String methods for Node.js. A security vulnerability exists in the string module. An attacker can exploit this vulnerability to cause a denial of service with the help of untrustworthy specially crafted input...

CVE-2017-16116

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

CVE-2017-16116

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

Design/Logic Flaw

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

CVE-2017-16116

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

CVE-2017-16116

The CVE-2017-16116 entry corresponds to the Node.js string module. The vulnerability is a regular expression denial of service (ReDoS) triggered by untrusted input passed to the underscore or unescapeHTML methods. Impact described as potential denial of service. Public remediation details in the ...

CVE-2017-16116

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...

PT-2018-6143

Name of the Vulnerable Software and Affected Versions: string affected versions not specified Description: The issue concerns a regular expression denial of service that occurs when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods of the string modul...

CVE-2017-16116: Uncontrolled Resource Consumption

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods...