752 matches found
Security Bulletin: Multiple vulnerabilities in Lightbend Spray spray-json affect IBM Application Performance Management products.
Summary Lightbend Spray spray-json is used by IBM Application Performance Management. Vulnerability Details CVEID:CVE-2018-18854 DESCRIPTION: Lightbend Spray spray-json is vulnerable to a denial of service, caused by an error during the parsing of many JSON object fields. By sending a...
PT-2023-7218 · Zabbix +4 · Zabbix +4
Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to a buffer overflow in the zabbix/src/libs/zbxjson module when parsing JSON files via the zbx json open function. This can potentially allow a remote attacker to execut...
CVE-2023-42278
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse...
Citrix Director throws “Unexpected Server Error” while clicking on the Trends Tab
Citrix Director throws “Unexpected Server Error” while clicking on the Trends Tab Event ID 5 is logged in Citrix Director, pointing to failure while connecting to data source. The CDF Traces captured from Director Server, show the exception "Unexpected character encountered while parsing value" D...
Debian dla-3516 : burp - security update
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3516 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3516-1 [email protected]...
Fedora 38 : yajl (2023-00572178e1)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-00572178e1 advisory. Security fix for memory leaks leading to denial of service CVE-2023-33460. Security fix for integer overflow leading to heap corruption CVE-2022-247...
json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)
A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...
json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)
A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...
json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)
A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...
Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder
Impact A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift...
PT-2026-88984
Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.20.5 Description A denial of service issue exists during the parsing of JSON in the LoginPacket due to improper validation within the JsonMapper dependency. The library fails to perform adequate checks when...
json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)
A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...
NETGEAR RAX30 rex_cgi JSON Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of JSON data. The issue results from the lack of proper...
OESA-2023-1223 json-smart security update
Json-smart is a performance focused, JSON processor lib. Security Fixes: Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to th...
OESA-2023-1203 json-smart security update
Json-smart is a performance focused, JSON processor lib. Security Fixes: Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to th...
g-http-java-client:JsonObjectParserFuzzer: Security exception in com.google.api.client.json.JsonParser.parseArray
Detailed Report: https://oss-fuzz.com/testcase?key=4744318480154624 Project: g-http-java-client Fuzzing Engine: libFuzzer Fuzz Target: JsonObjectParserFuzzer Job Type: libfuzzerasang-http-java-client Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal
Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6490039755603968 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...
CVE-2023-1305
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of...
Design/Logic Flaw
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of...
CVE-2023-1305 Rapid7 InsightCloudSec box object access
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of...