@augmt/request-header-parser-microservice (0.2.4), @sealcode/crud-ui (>=0.0.1-beta1, <=0.0.18) +80 more potentially affected by CVE-2017-16030 via useragent (>=2.0.0, <=2.1.9)

useragent NPM version =2.0.0, =0.0.1-beta1, =0.1.3, =0.17.29, =1.0.4, =0.1.7, =0.0.1, =3.0.3, =0.1.6, =0.1.2, =1.2.0, =0.0.1, =0.4.4, =0.5.4 and more Source cves: CVE-2017-16030 Source advisory: GHSA-PJMX-9XR3-82QR...

ReDoS via long UserAgent header in useragent

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed. Proof of Concept js var useragent = require'useragent'; var badUserAgent = 'MSIE 0.0'+Array900000.join'0'+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agen...

@augmt/request-header-parser-microservice (0.2.4), @sealcode/crud-ui (>=0.0.1-beta1, <=0.0.18) +80 more potentially affected by CVE-2017-16030 via useragent (>=2.0.0, <=2.1.9)

useragent NPM version =2.0.0, =0.0.1-beta1, =0.1.3, =0.17.29, =1.0.4, =0.1.7, =0.0.1, =3.0.3, =0.1.6, =0.1.2, =1.2.0, =0.0.1, =0.4.4, =0.5.4 and more Source cves: CVE-2017-16030 Source advisory: OSV:GHSA-PJMX-9XR3-82QR...

GHSA-PJMX-9XR3-82QR ReDoS via long UserAgent header in useragent

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed. Proof of Concept js var useragent = require'useragent'; var badUserAgent = 'MSIE 0.0'+Array900000.join'0'+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agen...

ReDoS via long UserAgent header in ua-parser

Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header. Recommendation No patch is currently available for this vulnerability. The best mitigation is currently to avoid using this package, using a different,...

Cross-site Scripting (XSS)

express-useragent is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the user-agent header, allowing XSS attacks to occur...

userSpice 4.3.24 X-Forwarded-For Cross Site Scripting

Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting Date: 2018-06-10 Author: Dolev Farhi Vendor or Software Link: www.userspice.com Version: 4.3.24 Tested on: Ubuntu Payload will get executed when admin visits the audit log page !/usr/bin/perl use strict; use LWP::UserAgent;...

CVE-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier...

CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2017-16086

CVE-2017-16086 affects the ua-parser-js module (ua-parser) and can be triggered by a specially crafted User-Agent header, causing a Regular Expression Denial of Service (ReDoS). The vulnerability is documented with a CVSS v3.0 base score of 7.5 (HIGH) and visible in NVD; a prior v2.0 score is 5.0...

CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2017-16086: Uncontrolled Resource Consumption

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

Node.js third-party modules: XSS in express-useragent through HTTP User-Agent

Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...

CVE-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier...

CVE-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier...

Code injection

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier...

CVE-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier...

CVE-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier...

@augmt/request-header-parser-microservice (0.2.4), @sealcode/crud-ui (>=0.0.1-beta1, <=0.0.18) +98 more potentially affected by CVE-2017-16030 via useragent (>=0.1.2, <=2.1.9)

useragent NPM version =0.1.2, =0.0.1-beta1, =0.1.3, =0.17.29, =1.0.4, =0.1.7, =0.0.1, =3.0.3, =0.1.6, =0.1.2, =1.2.0, =0.0.1, =0.0.2 and more Source cves: CVE-2017-16030 Source advisory: MEND:CVE-2017-16030...