341 matches found
CVE-2023-36281
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to loadprompt. This is related to subclasses or a template...
CVE-2023-36281
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to loadprompt. This is related to subclasses or a template...
CVE-2023-31441
In NATO Communications and Information Agency anet aka Advisor Network through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modifi...
Privilege escalation
In NATO Communications and Information Agency anet aka Advisor Network through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modifi...
CVE-2023-31441
In NATO Communications and Information Agency anet aka Advisor Network through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modifi...
Local file read through %load_json
Description When ALLOWPLANTUMLINCLUDE is set to false the default settings in the online server, !include processing is turned off, preventing local files from being read. However, other features like %loadjson can still access local files. Since many people will run plantuml-server in its defaul...
Cross site scripting
Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting XSS vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger...
CVE-2023-2587
Teltonika RMS (Remote Management System) and its RUT routers are affected by multiple CVEs (CVE-2023-32346, -32347, -32348, -32349, -32350, -2587, -2586, -2588) due to XSS, improper authentication, SSRF, OS command injection, and exposed configuration. RMS pre-4.10.0 and RMS pre-4.14.0 (for -2586...
The vulnerability of NETGEAR RAX30 router microprogramming software lies in the lack of proper verification of the length of user data before it is copied into the fixed-length stack buffer. This allows a hacker to execute arbitrary code in the context of the root user.
The vulnerability of NETGEAR RAX30 router microprogramming software lies in the lack of proper verification of the length of user data before it is copied into the fixed-length stack buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the root context using...
SUSE-SU-2023:2135-1 Security update for libfastjson
This update for libfastjson fixes the following issues: - CVE-2020-12762: Fixed an integer overflow and out-of-bounds write via a large JSON file bsc1171479...
Updated libfastjson packages fix security vulnerability
Integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbufmemappend. CVE-2020-12762...
Duplicate Advisory: Arbitrary code execution in jfinal CMS
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8qhm-ch8h-xgjr. This link is maintained to preserve external references. Original Description Command execution vulnerability in the ActionEnter Class ins jfinal CMS version 5.1.0 allows attackers to execute...
CVE-2022-46175
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...
CVE-2022-45045
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated...
CVE-2022-45045
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated...
CVE-2022-45045
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated...
CVE-2022-45045
The CVE-2022-45045 issue affects Xiongmai NVR models such as MBD6304T (V4.02.R11.00000117.10001.131900.00000) and NBD6808T-PL (V4.02.R11.C7431119.12001.130000.00000). It allows an authenticated attacker to execute arbitrary OS commands as root by supplying a crafted JSON during an upgrade request...
CVE-2022-45045
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated...
CVE-2022-35269
A denial of service vulnerability exists in the webserver hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the...