92 matches found
OWASP__json-sanitizer_CVE-2020-13973_1-2-0
json-sanitizer JSON Sanitizer преобразует JSON-подобное содержимое в валидный JSON. Начало работы - Контакты Этот инструмент может быть подключён на любом конце конвейера данных, чтобы помочь удовлетворить принцип Постела: будьте консервативны в том, что делаете, и либеральны в том, что принимает...
burp-jq
Burp JQ Это расширение Burp для применения jq запросов к JSON-содержимому из просмотрщика HTTP-сообщений. Сборка root@kitploit: $ gradle fatJar Благодарности Burp JQ полагается на jackson-jq, Java-реализацию jq. jq jackson jackson-jq...
CVE-2022-28108
Selenium Chrome RCE Exploit Étendu Ce dépôt contient une version modifiée d'un module Metasploit qui exploite une vulnérabilité d'exécution de code à distance dans les anciennes versions de Selenium Server Grid. Veuillez lire attentivement ce README avant d'utiliser ce code. Remerciements au code...
CheatSheetHost
CheatSheetHost Un serveur web léger, piloté par le contenu, pour héberger des antisèches interactives et des documents de référence. Parfait pour les défis CTF Capture The Flag, le reverse engineering et la documentation technique. Idéal dans les laboratoires où l'on souhaite limiter ou renoncer ...
CVE-2025-65881
CVE-2025-65881 Le projet Zoo Management System v1.00 est vulnérable à une injection de scripts intersites XSS sur /zms/classes/Login.php?f=login en raison de : 1. Content-type invalide des réponses JSON sur /zms/classes/Login.php?f=login 2. Entrées utilisateur non assainies dans les réponses...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
GHSA-PMV8-RQ9R-6J72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...
SUSE CVE-2026-13218
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...
EUVD-2026-39594
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...
CVE-2026-13218
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
EUVD-2026-26278
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439 AgentFlow Local Web API Content-Type Validation Bypass
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
PT-2026-35970
Name of the Vulnerable Software and Affected Versions AgentFlow affected versions not specified Description The local web API fails to enforce application/json validation for non-JSON content types on the 'POST /api/runs' and 'POST /api/runs/validate' endpoints. This allows attackers to bypass...
CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization,...
EUVD-2025-198335
Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user...