PT-2022-6575 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 affected versions not specified Description: The issue is related to the handling of JSON data and results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based...

Exploit for Uncontrolled Recursion in Owasp Modsecurity

Detection-and-Mitigation-script-for-CVE-2021-42717 Detection a...

Moderate: Red Hat Security Advisory: yajl security update

An update for yajl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

deep-parse-json vulnerable to Prototype Pollution

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the proto property to be edited...

@companydotcom/company-skynet-core (>=1.0.2, <=2.0.17), @companydotcom/micro-application-core (>=2.0.7, <=2.0.18-alpha.0) +10 more potentially affected by CVE-2022-42743 via deep-parse-json (>=1.0.1, <=1.0.2)

deep-parse-json NPM version =1.0.1, =1.0.2, =2.0.7, =0.0.1, =0.0.1, =0.0.19, =6.5.7-0, =5.3.0, =1.0.0, =0.0.6, =0.0.1, =0.0.13 - redux-persist-nedb-storage 0.1.0 Source cves: CVE-2022-42743 Source advisory: OSV:GHSA-FF9J-PWXG-Q5P2...

CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1121 more potentially affected by CVE-2022-2421 via socket.io-parser (>=3.1.1, <=3.3.0)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2022-2421 Source advisory: OSV:GHSA-QM95-PGCG-QQFQ...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow when it parses scientific notation numbers present in JSON. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit Credit: Kevin Stubbings...

CVE-2022-23462

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service DOS when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit...

CVE-2022-23462 Stack Buffer Overflow in iowow

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service DOS when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit...

CVE-2022-23462

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service DOS when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit...

CVE-2022-23462: Buffer Copy without Checking Size of Input

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service DOS when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit...

PT-2022-16004 · Iowow · Iowow

Name of the Vulnerable Software and Affected Versions: IOWOW versions 1.4.15 and prior Description: The issue is related to a stack buffer overflow that can cause Denial of Service DOS when parsing scientific notation numbers in JSON. Recommendations: For versions 1.4.15 and prior, apply the patc...

cryptsetup:crypt2_load_proto_plain_json_fuzz: Use-of-uninitialized-value in google::protobuf::FastUInt64ToBufferLeft

Detailed Report: https://oss-fuzz.com/testcase?key=6558884429168640 Project: cryptsetup Fuzzing Engine: libFuzzer Fuzz Target: crypt2loadprotoplainjsonfuzz Job Type: libfuzzermsancryptsetup Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2022-40149

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

libyang:lyd_parse_mem_json: Heap-buffer-overflow in eval_expr_select

Project: https://github.com/CESNET/libyang.git Detailed Report: https://oss-fuzz.com/testcase?key=6162494053285888 Project: libyang Fuzzing Engine: afl Fuzz Target: lydparsememjson Job Type: aflasanlibyang Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x602000004c38...

GO-2022-0965 Unbounded recursion in JSON parsing in k8s.io/apimachinery

Unbounded recursion in JSON parsing allows malicious JSON input to cause excessive memory consumption or panics...

jettison:JsonFuzzer: Timeout in JsonFuzzer

Project: https://github.com/jettison-json/jettison.git Detailed Report: https://oss-fuzz.com/testcase?key=6208570705707008 Project: jettison Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanjettison Platform Id: linux Crash Type: Timeout exceeds 60 secs Crash Address: Cras...

libyang:lyd_parse_mem_json: Use-of-uninitialized-value in lyxp_token2str

Project: https://github.com/CESNET/libyang.git Detailed Report: https://oss-fuzz.com/testcase?key=6260614099501056 Project: libyang Fuzzing Engine: libFuzzer Fuzz Target: lydparsememjson Job Type: libfuzzermsanlibyang Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Design/Logic Flaw

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...