Archive
23 January 2017
Vulnerabilities first published on this day (UTC), newest first.
8 results · Clear filters · Feed
-
High 7.5
Regular Expression Denial of Service in marked
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in semver
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in uglify-js
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Symlink Arbitrary File Overwrite in tar
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
-
High 7.5
Regular Expression Denial of Service in ms
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
-
High 7.5CVE-2016-4793 Public exploit
CakePHP allows remote attackers to spoof their IP
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
-
High 8.1
Extbase for TYPO3 allows RCE
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
-
High 7.5
Ruby-saml allows attackers to perform XML signature wrapping attacks
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.