Detection-and-Mitigation-script-for-CVE-2021-42717

CVE-2021-42717 के लिए पहचान और शमन स्क्रिप्ट CVE-2021-42717 के लिए पहचान और शमन स्क्रिप्ट - JSON पार्सिंग में ModSecurity DoS भेद्यता ModSecurity 3.x से 3.0.5 अत्यधिक नेस्टेड JSON ऑब्जेक्ट्स को गलत तरीके से संभालता है। हजारों-लाखों गहराई तक नेस्टिंग वाले बनाए गए JSON ऑब्जेक्ट्स के परिणामस्वरूप वे...

CVE-2022-33171

CVE-2022-33171 : Injection SQL dans TypeORM Note : Il s'agit d'une analyse en cours de CVE-2022-33171. Les détails fournis ici peuvent être mis à jour à mesure que de nouvelles informations deviennent disponibles. Actuellement, cela ne fonctionne pas. Détails de la vulnérabilité ID CVE :...

Apache-couchdb-CVE-2017-12635

Couchdb vertikaler Privilegienumgehungs-Bug CVE-2017-12635 Apache CouchDB ist eine Open-Source-Datenbank, die sich auf Benutzerfreundlichkeit und darauf konzentriert, eine „vollständig das Web umarmende Datenbank“ zu sein. Es ist eine NoSQL-Datenbank, die JSON als Speicherformat, JavaScript als...

json_cve_2020_10663

Workaround für CVE-2020-10663 Sicherheitslücke im json-Gem Das json-Gem hat eine Sicherheitslücke CVE-2020-10663. Beim Parsen bestimmter JSON-Dokumente kann das json-Gem gezwungen werden, beliebige Objekte im Zielsystem zu erstellen. Benutzern wird dringend empfohlen, auf json 2.3.0 oder höher zu...

crack-0.1.8-fixed

= crack Analisi JSON e XML molto semplici, prese da Merb e Rails. Il parser XML è preso da Merb e il parser JSON è preso da Rails. Non prendo alcun merito, li ho solo impacchettati per il divertimento e l'uso facile di tutti. == nota sulle versioni Le versioni sono taggate su GitHub e anche...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Iniezione di operatori NoSQL non autenticata in Budibase Iniezione di operatori JSON/NoSQL non autenticata in Budibase. Qualsiasi visitatore anonimo di un'app Budibase pubblicata che espone una query PUBBLICA supportata da un datasource documentale MongoDB, CouchDB, Elasticsearch...

CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and...

couchdb-exploit

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 Apache CouchDB – Privilegieneskalation & Remote-Codeausführung 📖 Überblick Dieses Tool nutzt zwei kritische Schwachstellen in Apache CouchDB aus: CVE| Beschreibung| Schweregrad ---|---|--- CVE-2017-12635| Privilegieneskalation durch...

Linux Distros Unpatched Vulnerability : CVE-2026-66393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by...

CVE-2026-77070

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

Linux Distros Unpatched Vulnerability : CVE-2026-18140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every...

CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

CVE-2026-53708

creationtimestamp| type| source ---|---|--- 2026-08-14 20:35:03+00:00| published-proof-of-concept| https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-9hgc-g3w5-67cm...

MINI-JQHX-JHXR-GWXQ

Bulletin has no description...

CVE-2026-73555

A flaw was found in vLLM, an inference and serving engine for large language models. Unauthenticated attackers can send malformed JSON requests to various API endpoints, triggering validation errors. The system's error handling mechanism converts these validation errors into strings without...

CVE-2026-73071

A flaw was found in Vim. When processing an invalid JSON string that spans multiple buffers, the jsondecodeitem function can retain a stale pointer. This can lead to the program attempting to read freed memory, potentially resulting in a denial of service for a local user. Mitigation Not applicab...

UBUNTU-CVE-2026-73071

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring invokes channelfill to refill and free the current buffer, causing the error path to read freed memory instead of reader-jsbuf +...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

EUVD-2026-55990

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217 Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...