Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to regular expression denial of service due to a vulnerability in the Node.js validator module

Summary IBM App Connect Enterprise Certified Container may be vulnerable to a regular expression denial of service attack when parsing an Open API/Swagger document, due to a vulnerability in the Node.js validator module Vulnerability Details Third Party Entry: 207314 DESCRIPTION: Node.js validato...

6ix (=0.0.0-canary.0), 9ight (>=0.0.0-canary.0 <=0.0.0-canary.6) +2906 more potentially affected by CVE-2019-18413 via class-validator (>=0.10.0 <=0.13.2)

class-validator NPM version =0.10.0, =0.0.0-canary.0, =0.0.1, =1.0.4, =4.2.3, =2.7.0, =1.1.0, =1.1.0, =1.0.0, =0.0.1, =0.1.0, =0.0.2, =0.0.1, =0.0.13 and more Source cves: CVE-2019-18413 Source advisory: OSV:GHSA-FJ58-H2FR-3PP2...

GHSA-FJ58-H2FR-3PP2 SQL Injection and Cross-site Scripting in class-validator

In TypeStack class-validator, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented a...

SQL Injection and Cross-site Scripting in class-validator

In TypeStack class-validator, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented a...

Regular Expression Denial Of Service (ReDoS)

devextreme is vulnerable to regular expression denial of service. The vulnerability exists in validationengine.js because Incorrect sanitations in email validator allows an attacker to use malicious inputs resulting in denial of service conditions...

Inefficient Regular Expression Complexity in yiminghe/async-validator

✍️ Description It allows cause a denial of service when validating crafted invalid URLs. 🕵️‍♂️ Proof of Concept // PoC.js var asyncValidator = require"async-validator" const validator = new asyncValidator.default v: type: 'url', , forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr =...

Large Validator Sets/Rapid Validator Set Updates May Freeze the Bridge or Relayers

Handle nascent Vulnerability details In a similar vein to "Freeze The Bridge Via Large ERC20 Names/Symbols/Denoms", a sufficiently large validator set or sufficiently rapid validator update could cause both the ethoraclemainloop and relayermainloop to fall into a state of perpetual errors. In...

The gravity.sol router should have pause/unpause functionality.

Handle tensors Vulnerability details In case a hack is occuring or an exploit is discovered, the team or validators in this case should be able to pause functionality until the necessary changes are made to the system. Additionally, the gravity.sol contract should be manged by proxy so that...

Win all relayer rewards

Handle nascent Vulnerability details "Large Validator Sets/Rapid Validator Set Updates May Freeze the Bridge or Relayer" can affect just the relayers & not affect the oracle in certain circumstances. This could result in valid attestations, but prevent any of the other relayers from being able to...

Large ValSets potentially freezes Gravity.sol

Handle nascent Vulnerability details Gas requirements of makeCheckpoint: If the size of the validator set grows large enough during a time of block-size expansion, it may be possible to make the validator set large enough that, when the block size shrinks, the gas required to perform makeCheckpoi...

OESA-2021-1332 hibernate-validator security update

This is the reference implementation of JSR-349 - Bean Validation 1.1. Bean Validation defines a meta-data model and API for JavaBean as well as method validation. The default meta-data source are annotations, with the ability to override and extend the meta-data through the use of XML validation...

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

PHPMailer untrusted code may be run from an overridden address validator

If a function is defined that has the same name as the default built-in email address validation scheme php, it will be called in default configuration as when no validation scheme is provided, the default scheme's callable php was being called. If an attacker is able to inject such a function in...

GHSA-77MR-WC79-M8J3 PHPMailer untrusted code may be run from an overridden address validator

If a function is defined that has the same name as the default built-in email address validation scheme php, it will be called in default configuration as when no validation scheme is provided, the default scheme's callable php was being called. If an attacker is able to inject such a function in...

CVE-2021-3603

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called if such code is injected into the host project's scope by other means. If the $patternselect parameter to validateAddress is set to 'php' the default, defined by PHPMailer::$validator, and the globa...

CVE-2021-3603

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called if such code is injected into the host project's scope by other means. If the $patternselect parameter to validateAddress is set to 'php' the default, defined by PHPMailer::$validator, and the globa...

Untrusted code may be run from an overridden address validator

This is a security release. SECURITY Fixes CVE-2021-34551, a complex RCE affecting Windows hosts. See SECURITY.md for details. The fix for this issue changes the way that language files are loaded. While they remain in the same PHP-like format, they are processed as plain text, and any code in th...

GHSA-QM57-VHQ3-3FWF Header injection possible in Django

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 with Python 3.9.5+, URLValidator does not prohibit newlines and tabs unless the URLField form field is used. If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffecte...

Security Bulletin: CVE-2020-15366 An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2.

Summary CVE-2020-15366 An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an...

ai.grakn.kgms:client (=1.4.3), ai.grakn:client-java (>=1.4.1 <=1.4.3) +9502 more potentially affected by CVE-2020-10693 via org.hibernate:hibernate-validator (>=3.0.0.GA <=6.0.1.Final)

org.hibernate:hibernate-validator MAVEN version =3.0.0.GA, =1.4.1, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.7.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =1.4.1, =0.13.0, =0.13.0, =0.14.0 and more Source cves: CVE-2020-10693 Source advisory: OSV:GHSA-RMRM-75HP-PHR2...