Detection-and-Mitigation-script-for-CVE-2021-42717

Detection-and-Mitigation-script-for-CVE-2021-42717 用于 CVE-2021-42717 的检测与缓解脚本 - ModSecurity JSON 解析中的 DoS 漏洞 ModSecurity 3.x 至 3.0.5 错误处理了过度嵌套的 JSON 对象。精心构造的 JSON 对象可嵌套数万层深，可能导致 Web 服务器无法为合法请求提供服务。即使是一个中等大小（例如 300KB）的 HTTP 请求，也可能占用有限的 NGINX 工作进程之一长达数分钟，并消耗机器上几乎全部可用的 CPU。ModSecurity 2...

Apache-couchdb-CVE-2017-12635

Couchdb 垂直权限绕过漏洞（CVE-2017-12635） Apache CouchDB是一个开源数据库，专注于易用性和成为"完全拥抱web的数据库"。它是一个使用JSON作为存储格式，JavaScript作为查询语言，MapReduce和HTTP作为API的NoSQL数据库。应用广泛，如BBC用在其动态内容展示平台，Credit Suisse用在其内部的商品部门的市场框架，Meebo，用在其社交平台（web和应用程序）。...

json_cve_2020_10663

Solución alternativa para CVE-2020-10663 vulnerabilidad en la gema json La gema json tiene una vulnerabilidad de seguridad CVE-2020-10663. Al analizar ciertos documentos JSON, la gema json puede ser forzada a crear objetos arbitrarios en el sistema de destino. Se recomienda encarecidamente a los...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Inyección de operadores NoSQL no autenticada en Budibase Inyección de operadores JSON/NoSQL no autenticada en Budibase. Cualquier visitante anónimo de una aplicación Budibase publicada que exponga una consulta PÚBLICA respaldada por una fuente de datos de documentos MongoDB,...

crack-0.1.8-fixed

= crack Análisis realmente simple de JSON y XML, extraído de Merb y Rails. El analizador XML está extraído de Merb y el analizador JSON de Rails. No me atribuyo el mérito, solo los empaqueté para que todos los disfruten y los usen fácilmente. == nota sobre versiones Las versiones se etiquetan en...

couchdb-exploit

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 Apache CouchDB - Privilege Escalation & Remote Code Execution 📖 Overview This tool exploits two critical vulnerabilities in Apache CouchDB: CVE| Description| Severity ---|---|--- CVE-2017-12635| Privilege Escalation via JSON Parsing Bypass| 🔴...

CVE-2022-33171

CVE-2022-33171：TypeORM SQL 注入 注意：这是对 CVE-2022-33171 的进行中分析。此处提供的详细信息可能会随着进一步信息的公开而更新。当前无法正常工作 漏洞详情 CVE ID： CVE-2022-33171 产品： TypeORM 受影响版本： 0.3.0 漏洞类型： SQL 注入 披露日期： 2022年6月28日 描述 在 0.3.0 版本之前的 TypeORM 中，findOneid 和 findOneOrFailid 函数可以接收字符串或 FindOneOptions 对象。当该函数的输入是用户控制的已解析 JSON 对象时，提供精心构造的...

Fedora 45 : mongo-c-driver (2026-83792d666c)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-83792d666c advisory. libmongoc 2.5.2 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

CVE-2026-0915-json-Patch.-V2.0

Uploading 1000000837.png… CVE-2026-0915-json-Patch.-V2.0 Patch the Bug - glibc 🔒 Parche de Seguridad para Validador JSON Solución de nivel empresarial para CVE-2026-0915 - Protege contra el análisis JSON inseguro mediante una validación estricta de esquemas. 🚨 Aviso de seguridad Este parche...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54390

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

EUVD-2024-55754

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in the LoginPacket JSON parsing logic, caused by improper validation in the JsonMapper dependency. An unauthenticated attacker can send malformed JSON structures within a LoginPacket to crash the server . The CVSS v3.1...

CVE-2023-54393 PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

EUVD-2023-60621

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2023-54390

PocketMine-MP versions before 5.3.1 and 4.23.1 are vulnerable to a denial of service caused by improper null value handling in arrays during LoginPacket JSON parsing. An unauthenticated, remote attacker can send malformed JSON containing unexpected null elements in the LoginPacket to crash the se...

CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2022-51009

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...