thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

The vulnerability of the WordPress website content management system, related to insufficient validation of input data, allows attackers to compromise the integrity of the data.

The vulnerability of the WordPress website content management system is related to a JSON GET cache infection error. Exploiting this vulnerability allows an attacker to compromise data integrity...

DEBIAN-CVE-2020-10663

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsi...

CVE-2019-10805

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function hasOwnProperty from the unsafe user-input to examine an object. It is possible for a crafted payload to overwri...

CVE-2019-10805

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function hasOwnProperty from the unsafe user-input to examine an object. It is possible for a crafted payload to overwri...

CVE-2019-10805

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function hasOwnProperty from the unsafe user-input to examine an object. It is possible for a crafted payload to overwri...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to gain full control over the system.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis is related to the lack of a mechanism for checking input data. Exploiting this vulnerability could allow an attacker to gain full control over the system...

PYSEC-2020-156

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

PYSEC-2020-156

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

CVE-2019-10781

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...

CVE-2019-10781

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...

Code injection

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...

CVE-2019-10781

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...

CVE-2019-10781

Schema-inspector (JS package) is affected by CVE-2019-10781 through versions before 1.6.9. A specially crafted JavaScript object can bypass sanitize() and validate(), enabling information exposure and potential property tampering. The root cause is the bypass of input sanitisation/validation with...

DEBIAN-CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a...

Vulnerabilities in JavaScript object handling functions of Firefox browsers, Firefox ESR, and Thunderbird email client, allowing attackers to access confidential information and cause service failures

The vulnerability in the JavaScript object handling functions of Firefox browsers, Firefox ESR, and the email client Thunderbird is related to a lack of type conversion mechanisms. Exploiting this vulnerability can allow an attacker to gain access to confidential information and cause service...

The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows a hacker to read arbitrary files on the server.

The vulnerability of the Jackson-databind library is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files on the server using a specially created JSON message...

The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows attackers to read arbitrary files on the server.

The vulnerability of the Jackson-databind library is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files on the server by sending a specially crafted JSON message...

The vulnerability of the FasterXM Java library for JSON file grammar analysis, jackson-databind, allows a attacker to execute arbitrary code.

The vulnerability of the FasterXML function net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup in the Jackson-Databind JSON file parsing library involves memory corruption due to an unreliable data structure. Exploiting this vulnerability could allow a malicious actor to execute...

kube-apiserver: DoS with crafted patch of type json-patch

A denial of service vulnerability was found in the Kubernetes API server. A remote user, with authorization to apply patches, could exploit this via crafted JSON input, causing excessive consumption of resources and subsequent denial of service...