Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,698 results · page 15 of 34
Sep 26, 2022The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitizaCVE-2022-21169 · Other software · Express XSS Sanitizer Project · reported by report@snyk.ioHigh 7.3
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
- Product
- Express XSS Sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.CVE-2022-37259 · Other software · Stealjs · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.CVE-2022-37260 · Other software · Stealjs · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.CVE-2022-37262 · Other software · Stealjs · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.
- Product
- Steal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse.CVE-2022-40023 · Other software · Sqlalchemy · reported by MITREHigh 7.5
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
- Product
- Mako
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticatCVE-2022-29158 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Aug 30, 2022An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.CVE-2022-27563 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 30, 2022HCL VersionVault Express exposes administrator credentials.CVE-2022-27560 · Other software · HCL Software · reported by psirt@hcl.comMedium 6
HCL VersionVault Express exposes administrator credentials.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 30, 2022The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logiCVE-2022-25887 · Other software · Apostrophecms · reported by report@snyk.ioMedium 5.3
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
- Product
- Sanitize-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU.CVE-2021-3929 · Other software · Qemu · reported by Red HatHigh 8.2
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 24, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary CVE-2021-43309 · Other software · uri-template-lite · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
- Product
- uri-template-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Aug 22, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary inputCVE-2022-1930 · Other software · eth-account · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method
- Product
- eth-account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Aug 3, 2022This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress.CVE-2022-28684 · Other software · DevExpress · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.
- Product
- DevExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Aug 1, 2022Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.CVE-2022-2596 · Other software · node-fetch · reported by security@huntr.devMedium 5.9
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.
- Product
- node-fetch/node-fetch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge caCVE-2022-34749 · Other software · Mistune Project · reported by MITREHigh 7.5
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
- Product
- Mistune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMCVE-2022-1310 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 24, 2022A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption.CVE-2022-24294 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.
- Product
- Apache MXNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 15, 2022The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular exCVE-2022-25858 · Other software · Terser · reported by report@snyk.ioMedium 5.3
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
- Product
- Terser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types.CVE-2022-31781 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
- Product
- Apache Tapestry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 6, 2022Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS)CVE-2022-20813 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jul 6, 2022Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS)CVE-2022-20812 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jul 5, 2022network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SCVE-2022-33743 · Computers, phones & browsers · Linux · reported by security@xen.orgHigh 7.8
network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Jul 1, 2022All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insCVE-2022-25758 · Other software · Scss-tokenizer Project · reported by report@snyk.ioMedium 5.3
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
- Product
- Scss-tokenizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior toCVE-2022-1954 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022rulex is a new, portable, regular expression language.CVE-2022-31099 · Other software · rulex-rs · reported by GitHubMedium 6.5
rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.
- Product
- rulex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022rulex is a new, portable, regular expression language.CVE-2022-31100 · Other software · rulex-rs · reported by GitHubMedium 6.5
rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to slice into the code point and panics as a result. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the thread running rulex panics. The crashes are fixed in version **0.4.3**. Affected users are advised to update to this version. The only known workaround for this issue is to assume that regular expression parsing will panic and to add logic to catch panics.
- Product
- rulex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.CVE-2021-40901 · Other software · Scniro-validator Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
- Product
- Scniro-validator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.CVE-2021-40900 · Other software · Regexfn Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
- Product
- Regexfn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.CVE-2021-40899 · Other software · Repo-git-downloader Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.
- Product
- Repo-git-downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.CVE-2021-40898 · Other software · Scaffold-helper Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
- Product
- Scaffold-helper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.CVE-2021-40897 · Other software · Split-html-to-chars Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.
- Product
- Split-html-to-chars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.CVE-2021-40896 · Other software · That-value Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
- Product
- That-value
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.CVE-2021-40895 · Other software · Todo-regex Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
- Product
- Todo-regex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.CVE-2021-40894 · Other software · Underscore-99xp Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
- Product
- Underscore-99xp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.CVE-2021-40893 · Other software · Validate Data Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
- Product
- Validate Data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS proCVE-2022-30118 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Jun 24, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.CVE-2021-40892 · Other software · Validate Color Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
- Product
- Validate Color
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain qCVE-2022-22980 · Other software · VMware · reported by security@vmware.comCritical 9.8
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- Product
- Spring Data Mongodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtanzu.vmware.comtanzu.vmware.com
Jun 18, 2022python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial CVE-2021-46823 · Other software · Python-ldap · reported by MITREMedium 6.5
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
- Product
- Python-ldap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Jun 17, 2022A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated CVE-2022-31784 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.
- Product
- Mivoice Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to tCVE-2022-1929 · Other software · devcert · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
- Product
- devcert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbiCVE-2021-43308 · Other software · markdown-link-extractor · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
- Product
- markdown-link-extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary inputCVE-2021-43307 · Other software · semver-regex · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
- Product
- semver-regex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary CVE-2021-43306 · Other software · jquery-validation · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
- Product
- jquery-validation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
May 27, 2022Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couldCVE-2022-20807 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 27, 2022Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couldCVE-2022-20806 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 26, 2022Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couldCVE-2022-20809 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 25, 2022VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.CVE-2021-27779 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.1
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 20, 2022All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.CVE-2022-21195 · Other software · Url-regex Project · reported by report@snyk.ioMedium 5.3
All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
- Product
- Url-regex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2022An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of ServiCVE-2022-28946 · Other software · Openpolicyagent · reported by MITREHigh 7.5
An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
- Product
- Open Policy Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.