CVE-2019-1010239

DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSONGetObjectItemCaseSensitive function. The attack vector is: crafted json file. The fixed version is: 1.7...

PT-2019-5668 · Dave Gamble · Cjson

Name of the Vulnerable Software and Affected Versions: DaveGamble/cJSON versions 1.7.8 Description: The issue is related to an improper check for unusual or exceptional conditions, which can lead to a null dereference. This can cause a denial of service when a crafted JSON file is used as an atta...

Remote Code Execution (RCE)

github.com/prasmussen/glot-code-runner is vulnerable to remote code execution RCE. It uses os.system within a "python" "files" "content" JSON file since it adopts default configuration of glot-www...

CVE-2018-15747

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file...

CMSeeK v1.0.5 - CMS Detection And Exploitation Suite

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.5 19-07-2018 - Version 1.0.4...

Millions of Apps Leak Private User Data Via Leaky Ad SDKs

SAN FRANCISCO – Millions of apps leak personal identifiable information such as name, age, income and possibly even phone numbers and email addresses. At fault are app developers who do not protect ad-targeting data transmitted to third-party advertisers. “The scale of what we first thought was...

GHSA-WWH7-4JW9-33X6 yajl-ruby gem Denial of Service vulnerability

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service...

yajl-ruby gem Denial of Service vulnerability

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service...

Octopus Deploy Information Disclosure Vulnerability

Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

SUSE-SU-2017:2950-1 Security update for jq

This update for jq fixes the following issues: Security issues fixed: - CVE-2016-4074: The jvdumpterm function in jq allowed remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. bsc1014176 Non-security issues fixed: - Update tests...

CVE-2017-16516

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service...

CVE-2017-16516

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service...

CVE-2017-15609

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

Code injection

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15609

Octopus Deploy is affected under CVE-2017-15609 up to version 3.17.7. The vulnerability, described by OpenVAS as: “Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets,” stems from reading an insecu...

Medium: jq

Issue Overview: A heap-based buffer overflow flaw was found in the tokenadd function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system. CVE-2015-8863 Affected Packages: jq...

CVE-2016-4074

The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...

ALPINE-CVE-2016-4074

The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...

CVE-2016-4074

The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...

Design/Logic Flaw

The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...