Erik-Krogh

The SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue may lead to Denial of Service (DoS). The vulnerability was introduced by commit `e75e358` and has been fixed in sqlparse 0.4.4 by commit `c457abd5f`.

The issue arises when handling untrusted modal titles, allowing an attacker to influence the `title` field and supply arbitrary `html` or `javascript` code. This code will be rendered in the context of a user, potentially leading to cross-site scripting (XSS).

The issue is related to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who can influence the `placeholder` field when creating a `Calendar` instance can supply arbitrary `html` or `javascript` that will be rendered in the context of a user, leading to XSS.

Cockpit is a content management system that allows addition of content management functionality to any site. In the affected versions, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues.

The issue concerns a copy-paste cross-site scripting (XSS) flaw. This type of XSS requires the victim to be tricked into copying a malicious payload into the text editor.

Vditor is a browser-side Markdown editor. The issue at hand is a copy-paste cross-site scripting (XSS) problem. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor.

The issue is related to copy-paste cross-site scripting (XSS) in textAngular, a text editor for Angular.js. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor.

The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors.

The issue is related to cross-site scripting when handling untrusted menus in Mind-elixir, a free, open source mind map core.

The issue concerns a code injection vulnerability via pasted input in Editor.js, a block-style editor. The `processHTML` method is vulnerable as it passes pasted input into the wrapper's `innerHTML`. This allows for potential code injection attacks.

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. It is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

The issue concerns cross-site scripting attacks that can occur when pasting specially crafted content into editable cells. This can be exploited by attackers to execute malicious scripts.

The issue is related to the incorrect handling of regular expressions in the url2 method of the jQuery Validation Plugin, which can lead to a denial of service when an attacker supplies arbitrary input. This is due to an incomplete fix for a previous issue. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the `url2` method, which is vulnerable to regular expression denial of service (ReDoS) attacks when an attacker can supply arbitrary input.

The mechanize library, used for automatically interacting with HTTP web servers, contains a regular expression vulnerable to regular expression denial of service (ReDoS). If a web server responds maliciously, mechanize could crash.

Name of the Vulnerable Software and Affected Versions: @joeattardi/emoji-button versions prior to 4.6.2 Description: The issue concerns two vectors for XSS attacks: a URL for a custom emoji and an i18n string. In both cases, a crafted value can insert a `script` tag into the page and execute malicious code. Recommendations: For versions prior to 4.6.2, upgrade to version 4.6.2 or later, which properly escapes strings inserted into the HTML document to resolve the issue.

Zulip is an open source team chat server that allows organization administrators to configure linkifiers, which automatically create links from messages sent by users, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks by configuring a quadratic-time regular expression in a linkifier and sending messages that exploited it. The regular expression attempted to parse user-provided regexes to verify they were safe from ReDoS, but this was insufficient and itself subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex.

The issue allows for cross-site scripting (XSS) attacks via clipboard content. If a user can be tricked into copying malicious content and pasting it into the HTML editor, a part of the clipboard content is directly written to `innerHTML`, causing XSS. This enables JavaScript injection.

Name of the Vulnerable Software and Affected Versions: ssh2 versions prior to 1.4.0 Description: The issue is a command injection vulnerability that may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This issue only exists on Windows. Recommendations: For versions prior to 1.4.0, update to version 1.4.0 to resolve the issue. As a temporary workaround, consider validating and sanitizing any untrusted input before calling the vulnerable method to minimize the risk of exploitation.

The issue is related to a regular Expression Denial of Service in the sqlparse module for Python. The regular expression may cause exponential backtracking on strings containing many repetitions of `r ` in SQL comments. This affects the formatting feature that removes comments from SQL statements.

The issue arises when the `utils.set` function is called with user-controlled values, leading to code-injection. This can result in arbitrary code execution. The Total.js framework is a Node.js platform written in pure JavaScript, similar to PHP's Laravel or Python's Django.