CWE-185 Archives - CVE Vulnerability

CVE-2018-7536

Sun, 26 Feb 2023 06:51:05 +0000

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

The post CVE-2018-7536 appeared first on CVE Vulnerability.

CVE-2018-7537

Sun, 26 Feb 2023 06:51:05 +0000

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

The post CVE-2018-7537 appeared first on CVE Vulnerability.

CVE-2018-3737

Sun, 26 Feb 2023 06:49:47 +0000

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

The post CVE-2018-3737 appeared first on CVE Vulnerability.

CVE-2018-3738

Sun, 26 Feb 2023 06:49:47 +0000

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

The post CVE-2018-3738 appeared first on CVE Vulnerability.

CVE-2018-20801

Sun, 26 Feb 2023 06:48:44 +0000

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

The post CVE-2018-20801 appeared first on CVE Vulnerability.

CVE-2018-20164

Sun, 26 Feb 2023 06:48:29 +0000

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)

The post CVE-2018-20164 appeared first on CVE Vulnerability.

CVE-2018-17984

Sun, 26 Feb 2023 06:47:39 +0000

An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.

The post CVE-2018-17984 appeared first on CVE Vulnerability.

CVE-2018-11615

Sun, 26 Feb 2023 06:45:19 +0000

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

The post CVE-2018-11615 appeared first on CVE Vulnerability.

CVE-2020-2288

Sun, 26 Feb 2023 06:39:11 +0000

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.

The post CVE-2020-2288 appeared first on CVE Vulnerability.

CVE-2020-1741

Sun, 26 Feb 2023 06:38:29 +0000

A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user’s browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.

The post CVE-2020-1741 appeared first on CVE Vulnerability.