CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2017-20162 – vercel ms index.js parse redos
https://notcve.org/view.php?id=CVE-2017-20162
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662 https://github.com/vercel/ms/pull/89 https://github.com/vercel/ms/releases/tag/2.0.0 https://vuldb.com/?ctiid.217451 https://vuldb.com/?id.217451 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8315
https://notcve.org/view.php?id=CVE-2015-8315
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)." El paquete ms en versiones anteriores a 0.7.1 para Node.js permite a atacantes provocar una denegación de servicio (consumo de CPU) a través de una cadena de versión larga, vulnerabilidad también conocida como "denegación de servicio de expresión regular (ReDoS)". • http://www.openwall.com/lists/oss-security/2016/04/20/11 http://www.securityfocus.com/bid/96389 https://nodesecurity.io/advisories/46 https://support.f5.com/csp/article/K46337613?utm_source=f5support&%3Butm_medium=RSS • CWE-1333: Inefficient Regular Expression Complexity •