GitLab: JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions

The Quick Actions interpreter allows an attacker to reference a Project it does not have access to. The model attributes are then being serialized and returned to the user, which results in the Runner token both encrypted and unencrypted being returned to the user. This vulnerability is currently...

CVE-2016-5898

IBM Jazz Reporting Service JRS could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information...

Information disclosure

IBM Jazz Reporting Service JRS could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information...

CVE-2016-5898

IBM Jazz Reporting Service JRS could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information...

CVE-2016-5898: Undefined Security Weakness

IBM Jazz Reporting Service JRS could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information...

PT-2017-8810

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service JRS affected versions not specified Description The issue is caused by a lack of restriction on JSON serialization, allowing a remote attacker to obtain sensitive information by sending a direct request...

PHP JsonSerializable::jsonSerialize json_encode Local Denial of Service Vulnerability

PHP is an open source general-purpose computer scripting language. PHP 7.0 A local denial of service vulnerability exists in JsonSerializable::jsonSerialize jsonencode. Allows an attacker to exploit the vulnerability to launch a denial of service attack...

CVE-2013-7224

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

Cross site request forgery (csrf)

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

CVE-2013-7224

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

CVE-2013-7224

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

CVE-2013-7224

Fat Free CRM before 0.12.1 is vulnerable due to unrestricted JSON serialization, allowing remote attackers to obtain sensitive information via a direct request (e.g., /users/1.json). This is supported by multiple sources in connected documents. The issue has a confirmed fix; upgrading to 0.12.1 (...

CVE-2013-7224: Exposure of Sensitive Information to an Unauthorized Actor

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

PT-2014-3293

Name of the Vulnerable Software and Affected Versions Fat Free CRM versions prior to 0.12.1 Description The issue allows remote attackers to obtain sensitive information via a direct request. This is demonstrated by a request for "users/1.json", which is an API endpoint that is vulnerable due to...

[USN-1887-1] OpenStack Swift vulnerabilities

========================================================================== Ubuntu Security Notice USN-1887-1 June 20, 2013 swift vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

Ubuntu 12.04 LTS / 12.10 / 13.04 : swift vulnerabilities (USN-1887-1)

Sebastian Krahmer discovered that Swift used the loads function in the pickle Python module when it was configured to use memcached. A remote attacker on the same network as memcached could exploit this to execute arbitrary code. This update adds a new memcacheserializationsupport option to suppo...

USN-1887-1: OpenStack Swift vulnerabilities

Sebastian Krahmer discovered that Swift used the loads function in the pickle Python module when it was configured to use memcached. A remote attacker on the same network as memcached could exploit this to execute arbitrary code. This update adds a new memcacheserializationsupport option to suppo...

[SECURITY] Fedora 19 Update: php-pecl-jsonc-1.3.1-1.fc19

The php-pecl-jsonc module will add support for JSON JavaScript Object Nota tion serialization to PHP. This is a dropin alternative to standard PHP JSON extension which use the json-c library parser...