Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,698 results · page 17 of 34
Oct 1, 2021AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).CVE-2021-41862 · Other software · Aviatorscript Project · reported by MITRECritical 9.8
AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).
- Product
- Aviatorscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2021The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in HandCVE-2021-23446 · Other software · Handsontable · reported by report@snyk.ioHigh 7.5
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
- Product
- Handsontable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021nltk is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3828 · Other software · nltk · reported by security@huntr.devHigh 7.5
nltk is vulnerable to Inefficient Regular Expression Complexity
- Product
- nltk/nltk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021jsoneditor is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3822 · Other software · josdejong · reported by security@huntr.devHigh 7.5
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
- Product
- josdejong/jsoneditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021inflect is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3820 · Other software · pksunkara · reported by security@huntr.devHigh 7.5
inflect is vulnerable to Inefficient Regular Expression Complexity
- Product
- pksunkara/inflect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2021Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.CVE-2020-23478 · Other software · Leoeditor · reported by MITREHigh 7.5
Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
- Product
- LEO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Sep 22, 2021gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin.CVE-2020-23469 · Other software · Gmate Project · reported by MITREHigh 7.5
gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin.
- Product
- Gmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Sep 17, 2021XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.CVE-2021-41317 · Other software · XSS Hunter Express Project · reported by MITRECritical 9.8
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
- Product
- XSS Hunter Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Sep 17, 2021code-server is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3810 · Other software · cdr · reported by security@huntr.devHigh 7.5
code-server is vulnerable to Inefficient Regular Expression Complexity
- Product
- cdr/code-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021ansi-regex is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3807 · Other software · chalk · reported by security@huntr.devHigh 7.5
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
- Product
- chalk/ansi-regex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021taro is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3804 · Other software · nervjs · reported by security@huntr.devHigh 7.5
taro is vulnerable to Inefficient Regular Expression Complexity
- Product
- nervjs/taro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021nth-check is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3803 · Other software · fb55 · reported by security@huntr.devHigh 7.5
nth-check is vulnerable to Inefficient Regular Expression Complexity
- Product
- fb55/nth-check
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021semver-regex is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3795 · Other software · sindresorhus · reported by security@huntr.devHigh 7.5
semver-regex is vulnerable to Inefficient Regular Expression Complexity
- Product
- sindresorhus/semver-regex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021prism is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3801 · Other software · prismjs · reported by security@huntr.devMedium 6.5
prism is vulnerable to Inefficient Regular Expression Complexity
- Product
- prismjs/prism
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021vuelidate is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3794 · Other software · vuelidate · reported by security@huntr.devHigh 7.5
vuelidate is vulnerable to Inefficient Regular Expression Complexity
- Product
- vuelidate/vuelidate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021nodejs-tmpl is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3777 · Other software · daaku · reported by security@huntr.devHigh 7.5
nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity
- Product
- daaku/nodejs-tmpl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2021The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.CVE-2021-23437 · Other software · Python · reported by report@snyk.ioHigh 7.5
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Aug 31, 2021axios is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3749 · Other software · axios · reported by security@huntr.devHigh 7.5
axios is vulnerable to Inefficient Regular Expression Complexity
- Product
- axios/axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comgithub.com
Aug 18, 2021A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authentiCVE-2021-34716 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then uploading specific crafted software images to the affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 18, 2021A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticatCVE-2021-34715 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 18, 2021All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.CVE-2021-23425 · Other software · Trim-off-newlines Project · reported by report@snyk.ioMedium 5.3
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
- Product
- Trim-off-newlines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression.CVE-2021-33580 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
- Product
- Apache Roller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Aug 16, 2021The npm hbs package is an Express view engine wrapper for Handlebars.CVE-2021-32822 · Other software · pillarjs · reported by GitHubMedium 4
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
- Product
- hbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 12, 2021Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecifiedCVE-2020-22403 · Other software · Express-cart Project · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.
- Product
- Express-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file namCVE-2021-33199 · Other software · Expressionengine · reported by MITRECritical 9.8
In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg.
- Product
- Expressionengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule).CVE-2021-38592 · Other software · Wasm3 Project · reported by MITREHigh 7.5
Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule).
- Product
- Wasm3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Aug 4, 2021DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.CVE-2021-36483 · Other software · Devexpress · reported by MITREHigh 8.8
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
- Product
- Devexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsupportcenter.devexpress.com
Aug 2, 2021In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacCVE-2021-37914 · Other software · Argoproj · reported by MITREMedium 6.5
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
- Product
- Argo Workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2021ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter.CVE-2020-26565 · Other software · Objectplanet · reported by MITREHigh 7.5
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
- Product
- Opinio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comobjectplanet.com
Jul 20, 2021Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server.CVE-2021-2460 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected is Prior to 21.1.0.00.04. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Data Reporter. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Data Reporter, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Data Reporter accessible data as well as unauthorized read access to a subset of Oracle Application Express Data Reporter accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Application Express (APEX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2021chatwoot is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3649 · Other software · chatwoot · reported by security@huntr.devHigh 7.5
chatwoot is vulnerable to Inefficient Regular Expression Complexity
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js.CVE-2021-36716 · Other software · Segment · reported by MITREHigh 7.5
A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
- Product
- Is-email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTCVE-2021-27293 · Other software · Restsharp · reported by MITREHigh 7.5
RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.
- Product
- Restsharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrestsharp.dev
Jun 28, 2021The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regCVE-2020-28200 · Other software · Dovecot · reported by MITREMedium 4.3
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovecot.orglists.fedoraproject.org
Jun 21, 2021A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.CVE-2021-29063 · Other software · Mpmath · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.
- Product
- Mpmath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attempCVE-2021-29061 · Other software · Vfsjfilechooser2 Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attempts to validate crafted URIs.
- Product
- Vfsjfilechooser2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOCVE-2020-27511 · Other software · Prototypejs · reported by MITREHigh 7.5
An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.
- Product
- Prototype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprototypejs.orggithub.com
Jun 21, 2021mongo-express is a web-based MongoDB admin interface, written with Node.js and express.CVE-2021-21422 · Other software · mongo-express · reported by GitHubHigh 8.1
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.
- Product
- mongo-express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provideCVE-2021-29060 · Other software · Color-string Project · reported by MITREMedium 5.3
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.
- Product
- Color-string
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provCVE-2021-29059 · Other software · Is-svg Project · reported by MITREHigh 7.5
A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.
- Product
- Is-svg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-siCVE-2021-1395 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
- Product
- Cisco Unified Contact Center Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jun 10, 2021There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0.CVE-2020-23308 · Other software · Jerryscript · reported by MITREHigh 7.5
There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.CVE-2021-23392 · Other software · Locutus · reported by report@snyk.ioMedium 5.3
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
- Product
- Locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.CVE-2021-23388 · Other software · Forms Project · reported by report@snyk.ioMedium 5.3
The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.
- Product
- Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unrespCVE-2020-1920 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
- Product
- react-native
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2021The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() methCVE-2021-33623 · Other software · Trim-newlines Project · reported by MITREHigh 7.5
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
- Product
- Trim-newlines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 26, 2021In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if theyCVE-2021-28170 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
- Product
- Jakarta Expression Language Implementation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
May 24, 2021The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it hCVE-2021-33502 · Other software · Normalize-url Project · reported by MITREHigh 7.5
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
- Product
- Normalize-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
May 22, 2021A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web paCVE-2021-1358 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites.
- Product
- Cisco Unified Contact Center Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 22, 2021Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated, remote attacker to conduct a cross-site scripting CVE-2021-1254 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities by injecting malicious code into the web-based management interface and persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. An attacker needs valid administrator credentials to inject the malicious script code.
- Product
- Cisco Unified Contact Center Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.