156 matches found
PYSEC-2024-40
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...
Stack overflow during recursive JSON parsing
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth...
io.jenkins.plugins:global-yaml-properties (>=1.17.vd2468d9c5e85, <=1.18.v880576ea_9508), io.jenkins.plugins:nested-data-reporting (5.2.1) potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1289.vd1c337fd5354)
org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1289.vd1c337fd5354 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.plugins:global-yaml-properties...
golang: encoding/gob: stack exhaustion in Decoder.Decode
A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...
SUSE CVE-2016-4421
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service deep recursion, stack consumption, and application crash via a packet that specifies deeply nested data...
SUSE CVE-2017-9617
In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion uncontrolled recursion in the dissectdaaponetag function in epan/dissectors/packet-daap.c in the DAAP dissector...
SUSE CVE-2017-12933
The finishnesteddata function in ext/standard/varunserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP...
io.jenkins.plugins:code-coverage-api (>=4.2.0, <=4.4.0), io.jenkins.plugins:nested-data-reporting (5.2.1) +1 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1228.vd93135a_2fb_25)
org.jenkins-ci.plugins:script-security MAVEN version 1228.vd93135a2fb25 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:code-coverage-api =4.2.0, =4.4.0 -...
golang: encoding/gob: stack exhaustion in Decoder.Decode
A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...
The vulnerability of the `process_nested_data` function in the PHP programming language allows a hacker to execute arbitrary code.
The vulnerability of the processnesteddata function in the PHP programming language is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
The vulnerability of the `process_nested_data` function in the PHP programming language allows a hacker to execute arbitrary code.
The vulnerability of the processnesteddata function in the PHP programming language is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
The vulnerability of the object_common1 function in the PHP programming language, related to reading beyond the buffer in memory, allows attackers to trigger a service failure.
The vulnerability of the objectcommon1 function in the PHP programming language is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure by using specially created serialized data, which are incorrectly processed...
CVE-2021-42717
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large e.g., 300KB HTTP request can occupy one of the limited NGINX worke...
Signotec signoPAD-API/Web Input Validation Error Vulnerability
Signotec signoPAD-API/Web is a web interface for integrating signotec signature pads from Signotec Germany. The product includes features such as document management and memory management. An input validation error vulnerability exists in Signotec signoPAD-API/Web versions prior to 3.1.1 Windows...
sensu: Password exposure in warn level log when configured for multiple rabbitMQ connections
Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text...
php: Out-of-bounds heap read on unserialize in finish_nested_data()
The objectcommon1 function in ext/standard/varunserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service buffer over-read and application crash via crafted serialized data that is mishandled in a finishnesteddata call...
php: buffer over-read in finish_nested_data function
The finishnesteddata function in ext/standard/varunserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP...
sensu: Password exposure in warn level log when configured for multiple rabbitMQ connections
Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text...
sensu: Password exposure in warn level log when configured for multiple rabbitMQ connections
Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text...
The vulnerability of the `finish_nested_data` function in the PHP interpreter allows a attacker to potentially compromise the integrity of data.
The vulnerability of the finishnesteddata function in the PHP interpreter’s ext/standard/varunserializer.re module arises from the execution of an operation outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to potentially compromise the integrity of PHP dat...