Published: 23/01/2017 Updated: 07/11/2023

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 695

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The duration function in the moment package prior to 2.11.2 for Node.js allows remote malicious users to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Vulnerable Product	Search on Vulmon	Subscribe to Product
momentjs moment
tenable nessus
oracle primavera unifier

The duration function in the moment package before 2112 for Nodejs allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)" ...

Nessus leverages third-party software to help provide underlying functionality Two separate third-party components (OpenSSL and Momentjs) were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address ...

web-secure

web-secure ISO27001 Nullify Slow HTTP POST vulnerability External Security Review Finding The web server is possibly vulnerable to a "slow HTTP POST" Denial of Service (DoS) attack This is an application-level DoS that consumes server resources by maintaining open connections for an extended period of time by slowly sending traffic to the server If the server mainta

Since the NIST Network Vulnerability Database (NVD) does not support the CVSS 3 Temporal scoring, the script in this repo tries to implement this functionality

NIST NVD Temporal CVSS 3 score calculator Purpose Since the NIST Network Vulnerability Database (NVD) does not support the CVSS 3 Temporal scoring, the script in this repo implements some logic to add this funcionality For any CVE, the scripts evaluates all the references recorded into NVD itself and enriches the Base vector string to compute a Temporal score Disclaimer This

CWE-400 https://nodesecurity.io/advisories/55 http://www.openwall.com/lists/oss-security/2016/04/20/11 http://www.securityfocus.com/bid/95849 http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html https://www.tenable.com/security/tns-2019-02 https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E https://nvd.nist.gov https://github.com/nccasia/web-secure https://access.redhat.com/security/cve/cve-2016-4055

CVE-2016-4055

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect