Tidwall Gjson 安全漏洞

GJSON is a Go package that provides a fast and easy way to get values from json documents. A denial of service vulnerability exists in GJSON versions prior to 1.6.5. An attacker can exploit this vulnerability to cause a denial of service via specially crafted JSON...

PT-2021-3184 · Gjson · Gjson

Name of the Vulnerable Software and Affected Versions: GJSON versions prior to 1.6.5 Description: The issue is related to an uncontrolled resource consumption in the GJSON library, which can be exploited by a remote attacker using a specially crafted JSON request to cause a denial of service. A...

CVE-2020-35380

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON...

DEBIAN-CVE-2020-35380

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON...

UBUNTU-CVE-2020-35380

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON...

CVE-2020-35380

GJSON (tidwall/gjson) vulnerable to denial of service due to crafted JSON; root cause is improper bounds checking leading to a panic. Affected versions are before 1.6.4; patch is to upgrade to 1.6.4 or newer. Impact is DoS (service disruption) without explicit remote code execution details in the...

Lightbend Play Framework Stack Depletion Vulnerability

Lightbend Play Framework is the United States Lightbend company a Java code library for building Web applications . A stack consumption vulnerability exists in Play Framework versions 2.6.0 through 2.8.2. The vulnerability can be exploited to cause infinite recursion via a specially crafted JSON...

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

RHEL 7 : python-flask (RHSA-2020:0870)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0870 advisory. Flask is a lightweight but extensible web development framework for Python based on the Werkzeug WSGI toolkit, and the Jinja 2 template engine...

Low: Red Hat Security Advisory: python-flask security update

An update for python-flask is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Security Advisory - Remote Code Execution Vulnerability in Fastjson

A remote code execution vulnerability exists in the open-source JSON parsing library Fastjson. Remote attackers can send crafted JSON data packets to exploit this vulnerability. Successfully exploit could allow the attacker to execute arbitrary code on the target Fastjson server. Vulnerability ID...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

CVE-2019-1002100

A denial of service vulnerability was found in the Kubernetes API server. A remote user, with authorization to apply patches, could exploit this via crafted JSON input, causing excessive consumption of resources and subsequent denial of service. Mitigation Remove ‘patch’ permissions from untruste...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to gain access to confidential data.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file parsing involves the ability to read any local files on the server when default typing is enabled. A special jar-connector-mysql-connector-java is also available and points to classes at the final JSON...