CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2021-35065 – glob-parent: Regular Expression Denial of Service
https://notcve.org/view.php?id=CVE-2021-35065
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression. El paquete glob-parent anterior a 6.0.1 para Node.js permite ataques ReDoS (Denegación de Servicio (DoS) de expresión regular) contra la expresión regular del recinto. A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability. • https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339 https://github.com/gulpjs/glob-parent/pull/49 https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294 https://access.redhat.com/security/cve/CVE-2021-35065 https://bugzilla.redhat.com/show_bug.cgi?id=2156324 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 3CVE-2020-28469 – Regular Expression Denial of Service (ReDoS)
https://notcve.org/view.php?id=CVE-2020-28469
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. Esto afecta al paquete glob-parent versiones anteriores a 5.1.2. La regex de enclosure usada para comprobar las cadenas que terminan en enclosure conteniendo el separador de ruta A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. • https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9 https://github.com/gulpjs/glob-parent/pull/36 https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092 https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 https://www.oracle.com/security-alerts/cpujan2022.html https://access.redhat.com/security/cve/CVE-2020-28469 https://bugzilla • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28503 – Prototype Pollution
https://notcve.org/view.php?id=CVE-2020-28503
The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality. Los paquetes copy-props versiones anteriores a 2.0.5, son vulnerables a una Contaminación de Prototipos por medio de la funcionalidad main • https://github.com/gulpjs/copy-props/pull/7 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088047 https://snyk.io/vuln/SNYK-JS-COPYPROPS-1082870 •