Most recent entries from all

bdu:2021-03242

certfr-2021-avi-943 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-943

EUVD-2026-26197

fkie_cve-2021-29060

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

GHSA-257v-vj4p-3w2h — Regular Expression Denial of Service (ReDOS)

Affected: npm: color-string

In the npm package `color-string`, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for linearly increasing input lengths for `hwb()` color strings.

Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length.

gsd-2021-29060

UBUNTU-CVE-2021-29060

Affected: Ubuntu:18.04:LTS: node-color-string, Ubuntu:20.04:LTS: node-color-string, Ubuntu:22.04:LTS: node-color-string, Ubuntu:24.04:LTS: node-color-string, Ubuntu:25.10: node-color-string, Ubuntu:26.04:LTS: node-color-string

WID-SEC-W-2023-0809 — IBM QRadar SIEM: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.