CWE-777: Regular Expression without Anchors
The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.
A kind of CWE-625 Permissive Regular Expression.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages 9.8 Critical
- steveiliop56 tinyauth tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by... 5.4 Medium
- apache traffic server Apache Traffic Server: Regex mappings match with malicious domain names 6.9 Medium
- webmin Webmin information disclosure via regex pattern 6.9 Medium
- jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +1 more +3 more jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat 7.6 High
- ntfy ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function 6.4 Medium
- showdownjs showdown Showdownjs Denial of Service 5.3 Medium