PT-2018-16268 · Samsung · Samsung Smartthings Hub

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17 Description: A buffer overflow issue exists in the credentials handler of the video-core's HTTP server. The video-core process incorrectly handles fields from a user-controlled JSON...

CVE-2018-3893

An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflo...

CVE-2018-3903

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The memcpy call...

PT-2018-16295 · Samsung · Samsung Smartthings Hub

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: The video-core process in the Samsung SmartThings Hub STH-ETH-250 device incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14292)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. samsungWifiScan handler is one of the WiFi network discovery handlers. A buffer overflow vulnerability exists in the samsungWifiScan handler of the video-core HT...

infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possibl...

CVE-2018-7904

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management...

Mozilla Firefox JSON Viewer Script Injection Vulnerability

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. Mozilla Firefox suffers from a JSON Viewer script injection vulnerability. An attacker can use this vulnerability to run script code in the JSON Viewer context, which can be used to steal cooki...

PYSEC-2018-112

Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the...

ALPINE-CVE-2018-5336

In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth...

Multiple Dahua Product Access Validation Vulnerabilities

Dahua NVR50XX and so on are network hard disk camera products of China Dahua Dahua company. A security vulnerability exists in several Dahua products. The vulnerability can be exploited by an attacker to perform other operations by forging json messages...

Fortinet FortiOS Denial of Service Vulnerability (CNVD-2017-35607)

FortiOS is an intuitive operating system that lets you control all security and networking features of all FortiGates throughout your network. A denial of service vulnerability exists in Fortinet FortiOS. A remote authenticated user can cause the target web interface to be temporarily unavailable...

LibSass 'json_mkstream()' function heap buffer overflow vulnerability

LibSass is an open source written in C using Sass CSS extension language parser . A heap buffer overflow vulnerability exists in the 'jsonmkstream' function of the sasscontext.cpp file in LibSass version 3.4.5. A remote attacker can exploit this vulnerability to cause a denial of service heap...

DEBIAN-CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

ESnet iPerf3 Heap Buffer Overflow Vulnerability

ESnet iPerf3 is a set of tools for testing maximum bandwidth in IP networks. A heap buffer overflow vulnerability exists in the JSON handling feature of Esnet iperf version 3.1.1. A remote attacker can exploit this vulnerability to cause a heap buffer overflow with a specially crafted JSON string...

CVE-2016-4425

Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service deep recursion, stack consumption, and crash via crafted JSON data...

The vulnerability of the MySQL database management system allows attackers to compromise the confidentiality of information.

The vulnerability of the MySQL database management system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to influence the confidentiality of information by manipulating the JSON server...

Jansson Denial of Service Vulnerability

Jansson is a C language library for encoding, decoding and generating JSON data . Jansson processing special json file has a security vulnerability , allowing remote attackers can build special json file for denial of service attacks...

The vulnerability of the SAP HANA database management system allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the XS engine hdbxsengine of the SAP HANA database management system is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code using a specially crafted HTTP request related to JSON...

PostgreSQL json or jsonb Data Denial of Service Vulnerability

PostgreSQL is an object-relational database management system that supports an extended subset of SQL standards. A security vulnerability exists in PostgreSQL that can be exploited by remote attackers to submit special json or jsonb data to crash the target service...