CVE-2021-34570

Phoenix Contact PLCnext Control devices (versions prior to 2021.0.5 LTS) are affected by CVE-2021-34570. The issue is a DoS caused by specially crafted JSON requests, reducing availability. The NVD/CVSS reports a HIGH impact with network attack vector and low complexity. Remediation in the provid...

CVE-2021-34570: Improper Input Validation

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests...

Code injection

An eval vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests...

CVE-2013-4409: Improper Input Validation

An eval vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests...

CVE-2019-17673

WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header...

Design/Logic Flaw

WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header...

CVE-2019-17673

WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header...

UBUNTU-CVE-2019-17673

WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header...

WordPress 3.8.x < 3.8.31 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...

WordPress 3.9.x < 3.9.29 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in Customizer. - An unspecified issue which could lead to disclosure of unauthenticated posts. - A cross-site scripting XSS...

Blue Ocean did not require CSRF tokens

Blue Ocean did not require CSRF tokens "crumbs" for POST requests with the Content-Type: application/json. Blue Ocean now requires that valid CSRF tokens are present in POST requests...

Cross site scripting

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests...

CVE-2017-7437

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests...

CVE-2017-7437: Improper Neutralization of Input During Web Page Generation

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests...

Code injection

An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can cause an unhandled exception resulting in denial of service. An attacker can send malicious JSON to trigger this vulnerability...

SOPHOS WAF JSON Filter Bypass

SECURITYLABS INTELLIGENT RESEARCH - SECURITY ADVISORY http://www.securitylabs.com.br/ ADVISORY/0115 - SOPHOS WAF WEBSERVER PROTECTION DOES NOT ANALYZE JSON DATA PRIORITY: MEDIUM TYPE: WAF Bypass 1 - About SecurityLabs Intelligent Research ----------------------------------------------- SecurityLa...