CVE-2018-20801

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-185

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-208026.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affec CVE-2018-208036.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in CVE-2018-208046.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue af CVE-2018-208056.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatc CVE-2018-208066.1Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).CVE-2018-208076.1An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x bef CVE-2018-208086.1An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is CVE-2018-208097.5A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure CVE-2018-208109.8Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX CVE-2018-208115.3A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.CVE-2018-208127.5An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists i CVE-2018-208139.8An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2.