52 matches found
GHSA-WW3V-6XJF-JV28 Uncontrolled Resource Consumption in Spray JSON
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack...
Security Advisory - Apache log4j2 remote code execution vulnerabilities in some Huawei products
Some Huawei products are affected by the Apache Log4j2 remote code execution vulnerabilities. The vulnerabilities are caused by a recursive parsing error in some functions of Apache Log4j2. An attacker can construct a malicious request to control log parameters to trigger a remote code execution...
Apache Log4j2 Remote Code Execution Vulnerability
Apache Log4j2 is a Java logging framework. Apache Log4j2 remote code execution vulnerability, due to the existence of recursive parsing of certain Apache Log4j2 features, an attacker can use the vulnerability to directly construct malicious requests and trigger remote code execution...
ALPINE-CVE-2018-16452
The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smbfdata via recursion...
CVE-2019-13955
Mikrotik RouterOS before 6.44.5 long-term release tree is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected...
AZL-7009 CVE-2019-6292 affecting package yaml-cpp for versions less than 0.6.2-6
An issue was discovered in singledocparser.cpp in yaml-cpp aka LibYaml-C++ 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote...
PT-2019-18079 · Libyaml +2 · Yaml-Cpp +2
Name of the Vulnerable Software and Affected Versions: yaml-cpp aka LibYaml-C++ version 0.6.2 Description: An issue in singledocparser.cpp causes a stack exhaustion problem due to recursive stack frames in functions like HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, and...
aa2 (>=0.9.0, <=0.9.1), abridge (>=1.0.0, <=1.1.6) +429 more potentially affected by CVE-2018-20993 via yaml-rust (>=0.2.2, <=0.3.5)
yaml-rust CARGO version =0.2.2, =0.9.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.0.0, =0.1.0, =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.3.4 - asuran-cli 0.1.1 and more Source cves: CVE-2018-20993 Source advisory: OSV:RUSTSEC-2018-0006...
CVE-2018-1158
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...
Updated gnupg2 packages fix multiple vulnerabilities
Updated gnupg2 package fixes security vulnerabilities: RFC 4880 permits OpenPGP keyholders to mark their primary keys and subkeys with a "key flags" packet that indicates the capabilities of the key. These are represented as a set of binary flags, including things like "This key may be used to...
