Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2021-29059

nodejs-is-svg: Regular expression denial of service if the application is provided and checks a crafted invalid SVG string

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Is-svg Project Redhat
Products
Is-svg Openshift
CVE-2021-28092

nodejs-is-svg: ReDoS via malicious string

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Is-svg Project Redhat
Products
Is-svg Acm Openshift