GHSA-WF8F-6423-GFXG Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

Overview A flaw in Jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array...

DEBIAN-CVE-2025-49128

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content t...

CVE-2025-49128

CVE-2025-49128 : Jackson-core contains a low-level JSON streaming parser/generator used by Jackson Data Processor. In versions 2.0.0 up to but not including 2.13.0, a flaw in JsonLocation._appendSourceDesc allows up to 500 bytes of unintended memory content to be included in exception messages wh...

PT-2025-24332

Name of the Vulnerable Software and Affected Versions jackson-core versions 2.0.0 through 2.13.0 Description A flaw in jackson-core's JsonLocation. appendSourceDesc method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array...

CVE-2024-52791

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and...

CVE-2023-48725

A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78. A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2022-45493

Buffer overflow vulnerability in function jsonparsekey in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 November 14, 2022 allows attackers to code arbitrary code and gain escalated privileges...

CVE-2022-45496

Buffer overflow vulnerability in function jsonparsestring in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 November 14, 2022 allows attackers to code arbitrary code and gain escalated privileges...

PT-2025-22802

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.18 Description The issue is related to a heap-based buffer over-read in the parse string function of the cJSON library. This occurs when cJSON ParseWithLength is called with a JSON string that has no trailing newlin...

CVE-2022-23462

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service DOS when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit...

CVE-2022-45491

Buffer overflow vulnerability in function jsonparsevalue in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 November 14, 2022 allows attackers to code arbitrary code and gain escalated privileges...

CVE-2020-1863

Huawei USG6000V with versions V500R001C20SPC300, V500R003C00SPC100, and V500R005C00SPC100 have an out-of-bounds read vulnerability. Due to a logical flaw in a JSON parsing routine, a remote, unauthenticated attacker could exploit this vulnerability to disrupt service in the affected products...

org.webjars.npm:class-validator (>=0.8.5, <=0.14.0), org.webjars.npm:image-thumbnail (1.0.15) +8 more potentially affected by CVE-2025-56200 via org.webjars.npm:validator (>=3.43.0, <=13.12.0)

org.webjars.npm:validator MAVEN version =3.43.0, =0.8.5, =3.1.2, =3.18.2, =3.25.1 Source cves: CVE-2025-56200 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14102004...

FreeBSD : Mozilla -- use-after-free while parsing JSON (f1f92cd3-116c-11f0-8b2c-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f1f92cd3-116c-11f0-8b2c-b42e991fc52e advisory. [email protected] reports: Parsing a JavaScript module as JSON could, under some circumstances, caus...

SUSE-SU-2025:20155-1 Security update for protobuf

This update for protobuf fixes the following issues: - CVE-2024-2410: Fixed use after free when parsing JSON from a stream bsc1223947...

Security update for protobuf

This update for protobuf fixes the following issues: CVE-2024-2410: Fixed use after free when parsing JSON from a stream bsc1223947. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run th...

@mockoon/cli (>=9.0.0, <=9.1.0), @mockoon/serverless (>=9.0.0, <=9.1.0) potentially affected by CVE-2025-59049 via @mockoon/commons-server (>=9.0.0, <=9.1.0)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =9.1.0 Source cves: CVE-2025-59049 Source advisory: OSV:GHSA-W7F9-WQC4-3WXR...

uberAgent - Splunk dashboard does not display information about applications and desktops from DaaS

Splunk dashboard CVAD/DaaS Applications & Desktops does not display any information about published applications and desktops for DAAS. uberAgent.log file located in C:\Windows\Temp on the machine used for Citrix Cloud monitoring shows the errors: 2025-03-05 12:11:08.145...

CVE-2025-0868

A vulnerability, that could result in Remote Code Execution RCE, has been found in DocsGPT. Due to improper parsing of JSON data using eval an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0...

DocsGPT Allows Remote Code Execution

A vulnerability, that could result in Remote Code Execution RCE, has been found in DocsGPT. Due to improper parsing of JSON data using eval an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0...