6xs (>=0.1.0, <=0.1.3), 7ghost (>=4.11.0, <=4.11.46) +2398 more potentially affected by CVE-2020-28472 via aws-sdk (>=2.0.0-rc1, <=2.813.0)

aws-sdk NPM version =2.0.0-rc1, =0.1.0, =4.11.0, =3.10.1, =2.0.0, =1.0.0, =0.1.0, =1.16.0, =2.0.0, =3.7.0 and more Source cves: CVE-2020-28472 Source advisory: SNYK:JS-AWSSDK-1059424...

OSV-2018-18 Heap-buffer-overflow in json_parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9847 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonparseobject jsonparse fileisjson...

Prototype Pollution in badopcode/nodash

Description ts-nodash is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var merge = require"ts-nodash".Merge const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted; mergeobj, payload;...

CVE-2020-26883

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

CVE-2020-26883

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

Design/Logic Flaw

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

CVE-2020-26883

Play Framework versions 2.6.0–2.8.2 contain a vulnerability caused by unbounded recursion during JSON parsing (notably in fromJson in form.scala per Veracode). This can lead to stack depletion/DoS via crafted JSON sent over the network. Affected components: Play Framework JSON parsing pathway; ro...

CVE-2020-26883

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

DEBIAN-CVE-2020-14382

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2jsonmetadata.c' in function...

@cloudacademy/integrations (>=0.0.2, <=0.0.15), @csnext/cs-data (>=0.0.128-beta.33, <=0.0.128-dev.28) +14 more potentially affected by CVE-2020-36649 via papaparse (>=5.0.0, <=5.1.1)

papaparse NPM version =5.0.0, =0.0.2, =0.0.128-beta.33, =1.5.2-alpha.1, =1.3.5, =0.0.3, =1.0.0, =0.1.0-prerelease.20210117145449, =5.0.0, =2.0.0, =0.1.2, =0.1.0-prerelease.20200903194013, =0.1.0-prerelease.20201214071805, =0.1.7, =1.1.12, =1.1.20 and more Source cves: CVE-2020-36649 Source...

@cc_server/api (>=1.4.0, <=1.7.0), @colmena/api (0.1.0) +16 more potentially affected by unknown CVE via loopback (>=3.0.0-alpha.2, <=3.23.0)

loopback NPM version =3.0.0-alpha.2, =1.4.0, =0.20.8, =0.20.8, =0.13.0-beta.1, =0.13.2-20171004211143, =0.13.2-20171004211143, =0.0.1, =0.13.2-20171004211143, =1.0.0, =1.0.3 - oe-batch-processing 2.0.0 - oe-cloud 2.0.0 - oe-data-acl 2.0.0 - oe-service-personalization 2.0.0 - oe-skeleton 2.0.0 and...

Design/Logic Flaw

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

Design/Logic Flaw

JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...

UBUNTU-CVE-2020-24345

DISPUTED JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...

Medium: ruby20

Issue Overview: An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. CVE-2018-16396 The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4...

Vulnerability of the com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig component. Java libraries for JSON file parsing, such as jackson-databind, which allow attackers to cause service failures.

The vulnerability of the com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig component is related to memory restoration of unreliable data during JSON file parsing by Java libraries. Exploiting this vulnerability may allow an attacker to cause service failures remotely...

Sophos VPN Web Panel 2020 Denial Of Service

Exploit Title: Sophos VPN Web Panel 2020 - Denial of Service Poc Date: 2020-06-17 Exploit Author: Berk KIRAS Vendor Homepage: https://www.sophos.com/ Version:2020 Web Panel Tested on: Apache Berk KIRAS PwC - Cyber Security Specialist Sophos VPN Web Portal Denial of Service Vulnerability System...

CVE-2020-10060

In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...

CVE-2020-10060

In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...

CVE-2020-10060

CVE-2020-10060 affects Zephyr’s UpdateHub module. The vulnerability arises in updatehub_probe: after JSON parsing, the code accesses objects[1], which can reference uninitialized stack memory if the JSON has fewer than two elements. This could crash the process, cause a denial of service, or pote...