USN-6310-1: json-c vulnerability

It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

PT-2023-25510 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: langchain version 0.0.171 Description: An issue in langchain allows a remote attacker to execute arbitrary code via a JSON file to the load prompt parameter. This is related to subclasses or a template. Recommendations: For langchain version...

Information Disclosure

net.sourceforge.plantuml: is vulnerable to Information Disclosure. A remote unauthenticated attacker is able to gain access to read local JSON files, and confirm existence of those via a local file read through %loadjson, when ALLOWPLANTUMLINCLUDE is set to false, resulting in disclosure of...

SUSE CVE-2020-12762

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbufmemappend...

HTTPLoot - An Automated Tool Which Can Simultaneously Crawl, Fill Forms, Trigger Error/Debug Pages And "Loot" Secrets Out Of The Client-Facing Code Of Sites

An automated tool which can simultaneously crawl, fill forms, trigger error/debug pages and "loot" secrets out of the client-facing code of sites. Usage To use the tool, you can grab any one of the pre-built binaries from the Releases section of the repository. If you want to build the source cod...

NodeBB 1.0.4 - 1.18.4 Path Traversal Vulnerability

NodeBB is prone to a path traversal vulnerability in the translator module. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[SECURITY] Fedora 36 Update: oci-seccomp-bpf-hook-1.2.6-2.fc36

OCI Hook to generate seccomp json files based on EBF syscalls used by contain er oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes...

The vulnerability of the JSON Schema application for checking and testing JSON files lies in the lack of adequate control over the modification of dynamically defined object properties, allowing a perpetrator to execute arbitrary code.

The vulnerability of the JSON Schema-based application for checking and testing JSON files is related to insufficient control over the modification of dynamically defined object properties during JSON file processing. Exploiting this vulnerability could allow a malicious actor, operating remotely...

Fedora: Security Advisory for oci-seccomp-bpf-hook (FEDORA-2022-24438de133)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for oci-seccomp-bpf-hook (FEDORA-2022-3e1ade35db)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Symlink Attack

github.com/argoproj/argo-cd is vulnerable to symlink attack. The vulnerability exists due to a lack of sufficient check if the application target directory contains plain Kubernetes YAML manifests allowing out-of-bound manifests and JSON files to leak from Argo CD repo-server...

CVE-2022-24904 Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's...

ArgoCD 后置链接漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

Arbitrary JSON and property file read vulnerability in Jenkins Extended Choice Parameter Plugin

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

CVE-2022-27203

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

Jenkins Plugin Extended Choice Parameter 路径遍历漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Extended Choice Parameter Plugin...

PT-2022-18290 · Jenkins · Jenkins Extended Choice Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier Description: The issue allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

App Layering - User's not getting assigned app layers at login - Elastic layer assignment JSON files changing or being reset to default

Users with elastically assigned app layers do not have those app layers showing up at login. Elastic layering assignment files are changing on the network share used for elastic app layers. Layers.json ElasticLayerAssignments.json...

NodeBB vulnerable to path traversal in translator module

Impact Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected languages/ directory. Patches The vulnerability has been patched as of v1.18.5. Workarounds Cherry-pick commit hash c8b2fc46dc698db687379106b3f01c71b80f495f to recei...

GHSA-PFJ7-2QFW-VWGM NodeBB vulnerable to path traversal in translator module

Impact Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected languages/ directory. Patches The vulnerability has been patched as of v1.18.5. Workarounds Cherry-pick commit hash c8b2fc46dc698db687379106b3f01c71b80f495f to recei...