The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsLearn about Denial of Service (DoS) vulnerabilities in an interactive lesson.
Start learningUpgrade nokogiri
to version 1.8.5 or higher.
nokogiri is an HTML, XML, SAX, and Reader parser. Among Nokogiri's features is the ability to search documents via XPath or CSS3 selectors.
Affected versions of this package are vulnerable to several Denial of Service (DoS) vulnerabilities. Nokogiri bundles the libxml2
library, which is vulnerable in versions through 2.9.6.
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval()
function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND
or XPATH_OP_OR
case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application
If --with-lzma
is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR
, as demonstrated by xmllint
infinite loop in LZMA decompression.