CVE-2022-41713 deep-object-diff 1.1.0 - Prototype Pollution

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited...

CVE-2022-25757

In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...

McAfee Email Gateway/McAfee Email and Web Security Appliance SQL注入漏洞

CVE ID：CVE-2013-7092 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 由于通过"eventscol", "eventid", "reason", "eventsorder", "emailstatusorder"和"emailstatuscol" JSON keys传递到/admin/cgi-bin/rpc/doReport/18的输入在被用于SQL查询前没有正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 McAfee Email and Web Security Appliance 5.x...

Sql injection

Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the 1 eventscol, 2 eventid, 3 reason, 4 eventsorder, 5 emailstatusorder, or 6 emailstatuscol JSON keys...