408 matches found
JSON gem has Improper Input Validation vulnerability
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...
GHSA-X457-CW4H-HQ5F JSON gem has Improper Input Validation vulnerability
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...
RCE in PATCH requests in Spring Data REST
Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code...
Cisco Evolved Programmable Network Privilege Escalation
The vulnerability of the application programming interface of the Cisco Evolved Programmable Network Manager and the Cisco Prime Infrastructure network lifecycle management tool relates to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to circumvent...
CVE-2016-1406
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID...
CVE-2016-1406
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID...
jq: heap-buffer-overflow in tokenadd() function
A heap-based buffer overflow flaw was found in jq's tokenadd function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system...
Updated jansson packages fix CVE-2016-4425
Updated jansson packages fix security vulnerability: Gustavo Grieco discovered that jansson did not limit the recursion depth when parsing JSON arrays and objects. This could allow remote attackers to cause a denial of service crash via stack exhaustion, using crafted JSON data CVE-2016-4425...
DEBIAN-CVE-2016-4425
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service deep recursion, stack consumption, and crash via crafted JSON data...
UBUNTU-CVE-2016-4425
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service deep recursion, stack consumption, and crash via crafted JSON data...
CVE-2016-4425
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service deep recursion, stack consumption, and crash via crafted JSON data...
PT-2016-5953
Name of the Vulnerable Software and Affected Versions Jansson versions 2.7 and earlier Description The issue allows context-dependent attackers to cause a denial of service through crafted JSON data, leading to deep recursion, stack consumption, and a crash. Recommendations For Jansson versions 2...
ALPINE-CVE-2016-4074
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
DEBIAN-CVE-2016-4074
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
AZL-6505 CVE-2016-4074 affecting package jq for versions less than 1.5-6
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
UBUNTU-CVE-2016-4074
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
CVE-2016-4074
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
CVE-2016-4074
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
CVE-2016-4074: Allocation of Resources Without Limits or Throttling
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
jq heap buffer overflow vulnerability
jq is a software developer Stephen Dolan developed a lightweight command-line JSON processor . A heap buffer overflow vulnerability exists in jq's tokenadd function, which can be exploited to cause a denial of service application crash with the help of a specially crafted JSON file...