WordPress Redux Framework plugin <= 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting vulnerability

Unauthenticated JSON File Upload to Stored Cross-Site Scripting vulnerability discovered by villu164 in WordPress Plugin Redux Framework versions = 4.4.17...

mysql: Server: JSON unspecified vulnerability (CPU Apr 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...

USN-6746-1: Google Guest Agent and Google OS Config Agent vulnerability

It was discovered that Google Guest Agent and Google OS Config Agent incorrectly handled certain JSON files. An attacker could possibly use this issue to cause a denial of service...

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. netresearch/jsonmapper allows objects to be hydrated from scalar types in JSON. However, due to the lack of validation in the code for this feature, it may output improperly initialized objects if applied to...

GHSA-H6J3-J35F-V2X7 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. netresearch/jsonmapper allows objects to be hydrated from scalar types in JSON. However, due to the lack of validation in the code for this feature, it may output improperly initialized objects if applied to...

Security Bulletin: Vulnerability in json affects IBM Process Mining CVE-2023-5072

Summary There is a vulnerability in json that could allow an remote attacker to cause a denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-5072 DESCRIPTION...

GHSA-92JH-GWCH-JQ38 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. This happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect. Code processing arrays in the JSON data could the...

club.mrxiao:express-java-common (>=1.0.0 <=1.0.2), club.mrxiao:express-java-jdl (>=1.0.0 <=1.0.2) +439 more potentially affected by CVE-2023-42278 via cn.hutool:hutool-json (>=4.0.0 <=5.8.21)

cn.hutool:hutool-json MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.3, =2.0.5, =2.0.1.B, =2.0.1.B, =2.0.1.B, =1.0.1, =1.0.3 and more Source cves: CVE-2023-42278 Source advisory: OSV:GHSA-RR66-QH5M-W6MX...

ph-json vulnerable to stack exhaustion

An issue was discovered ph-json through 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...

Code injection

An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...

CVE-2023-34612

An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...

PT-2023-24949 · Ph-Json · Ph-Json

Name of the Vulnerable Software and Affected Versions: ph-json versions 9.5.5 and earlier Description: An issue allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies. Recommendations: For versions 9.5.5 and earlier, consider...

GHSA-PQP3-8RRW-G8VM PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. This happened due to a bug in netresearch/jsonmapper. The library wasn't doing proper checks when mapping JSON arrays and objects onto scalar model properties such as strings. Patches The problem was fixed in a...

MGASA-2023-0159 Updated libfastjson packages fix security vulnerability

Integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbufmemappend. CVE-2020-12762...

SUSE CVE-2018-3280

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: JSON. Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

json.h 缓冲区错误漏洞

json.h is a simple single header solution for parsing JSON in C and C++ from the individual developer Neil Henning. A security vulnerability exists in sheredom json.h, which stems from the discovery of a buffer overflow vulnerability contained in the jsonparsenumber function. An attacker can...

Denial Of Service (DoS)

hutool-json is vulnerable to denial of service. The vulnerability exists due to an out-of-memory error which allows an attacker to cause an application crash via malicious input...

club.mrxiao:express-java-common (>=1.0.0 <=1.0.2), club.mrxiao:express-java-jdl (>=1.0.0 <=1.0.2) +263 more potentially affected by CVE-2022-45689 via cn.hutool:hutool-json (>=4.0.0 <=5.8.10)

cn.hutool:hutool-json MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.3, =2.0.5, =2.0.1.B, =2.0.1.B, =2.0.1.B, =1.0.1, =1.0.3 and more Source cves: CVE-2022-45689 Source advisory: OSV:GHSA-FXRC-HG6J-6V3X...

club.mrxiao:express-java-common (>=1.0.0 <=1.0.2), club.mrxiao:express-java-jdl (>=1.0.0 <=1.0.2) +263 more potentially affected by CVE-2022-45690 via cn.hutool:hutool-json (>=4.0.0 <=5.8.10)

cn.hutool:hutool-json MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.3, =2.0.5, =2.0.1.B, =2.0.1.B, =2.0.1.B, =1.0.1, =1.0.3 and more Source cves: CVE-2022-45690 Source advisory: OSV:GHSA-WHGH-G24C-3J5Q...

ai.api.libai.speech:libai-speech-gcp (>=1.4.9 <=1.6.12), ai.apiverse:apipulse (>='1.0.3' <=1.0.20) +17591 more potentially affected by CVE-2022-45688 via org.json:json (>=20070829 <=20220924)

org.json:json MAVEN version =20070829, =1.4.9, ='1.0.3', =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =0.5.0, =0.5.0, =0.5.0, =0.5.8, =0.5.0, =0.5.7, =0.5.0, =0.8.7 and more Source cves: CVE-2022-45688 Source advisory: OSV:GHSA-3VQJ-43W4-2Q58...