@types/ua-parser-js
NPM
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| >= 0.8.1, < 1.0.33, >= 0.7.30, < 0.7.33, >= 0.8.0, < 1.0.33 | 5.3 MEDIUM | — | ||
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function. | ||||
| = 1.0.0, = 0.8.0, = 0.7.29, >= 0.7.29, < 0.7.30, >= 0.8.0, < 0.8.1, >= 1.0.0, < 1.0.1 | 5 MEDIUM | 7.6 HIGH | ||
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component. | ||||
| >= 0.7.14, < 0.7.24 | 7.5 HIGH | 5 MEDIUM | ||
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time. | ||||
| < 0.7.23 | 7.5 HIGH | 5 MEDIUM | ||
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). | ||||
| < 0.7.22 | 7.5 HIGH | 5 MEDIUM | ||
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. | ||||