CVE-2024-33664

python-jose through 3.3.0 allows attackers to cause a denial of service resource consumption during a decode via a crafted JSON Web Encryption JWE token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319...

The vulnerability of the “is-my-json-valid” library on the Node.js software platform allows a perpetrator to trigger a service failure.

The vulnerability of the Node.js software library “is-my-json-valid” relates to an inefficient regular expression used for checking JSON fields. This allows a malicious actor, operating remotely, to cause a service failure by sending a specially crafted JSON file...

Cross site scripting

IDURAR aka idurar-erp-crm through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data...

Code injection

An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt JSON web token...

PT-2023-30716 · Unknown · Websiteguide

Name of the Vulnerable Software and Affected Versions: WebsiteGuide version 0.2 Description: An issue with insecure permissions in WebsiteGuide allows a remote attacker to gain escalated privileges by using a crafted JSON web token jwt. Recommendations: For WebsiteGuide version 0.2, consider...

CVE-2023-4883

Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF Virtual Network Function, and triggering the ogssbimessagefree function, which could cause a...

CVE-2022-45688 -A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service DoS via crafted JSON or XML data. Products Confirmed Not Affected No Brocade Fibre Channel Product from Broadcom Products is known to be affected by this vulnerability...

CVE-2023-39685

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

CVE-2023-39685

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

Design/Logic Flaw

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

CVE-2023-39685

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

PT-2023-27072 · Unknown · Hjson-Java

Name of the Vulnerable Software and Affected Versions: hjson-java versions up to v3.0.0 Description: The issue allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string. This can lead to a StringIndexOutOfBoundsException. Recommendations: For hjson-java versions up to...

hjson-java Code Injection Vulnerability

hjson-java is Hjson open source a json, java conversion library . A security vulnerability exists in versions prior to hjson-java v3.0.0 that stems from allowing an attacker to cause a denial of service DoS by supplying a crafted JSON string...

CVE-2023-39685

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service DoS via supplying a crafted JSON string...

CVE-2023-31441

In NATO Communications and Information Agency anet aka Advisor Network through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modifi...

Privilege escalation

In NATO Communications and Information Agency anet aka Advisor Network through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modifi...

Important: jettison

Issue Overview: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of servic...

Medium: libfastjson

Issue Overview: A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-127...

CVE-2023-2587

Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting XSS vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger...

PT-2023-20351 · Teltonika · Teltonika'S Remote Management System

Name of the Vulnerable Software and Affected Versions: Teltonika’s Remote Management System versions prior to 4.10.0 Description: The issue is related to a cross-site scripting XSS vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connect...