Apache-couchdb-CVE-2017-12635

Couchdb 수직 권한 우회 취약점CVE-2017-12635 Apache CouchDB는 사용 편의성과 "웹을 완전히 수용하는 데이터베이스"가 되는 데 중점을 둔 오픈소스 데이터베이스입니다. JSON을 저장 형식으로, JavaScript를 쿼리 언어로, MapReduce와 HTTP를 API로 사용하는 NoSQL 데이터베이스입니다. BBC는 동적 콘텐츠 표시 플랫폼에, Credit Suisse는 내부 상품 부문의 마켓 프레임워크에, Meebo는 소셜 플랫폼웹 및 애플리케이션에 사용하는 등 폭넓게 사용됩니다. 2017년 11월...

json_cve_2020_10663

CVE-2020-10663에 대한 해결 방법json gem 취약점 json gem에는 보안 취약점 CVE-2020-10663이 있습니다. 특정 JSON 문서를 구문 분석할 때 json gem은 대상 시스템에서 임의의 객체를 생성하도록 강제될 수 있습니다. 사용자는 json 2.3.0 이상으로 업그레이드할 것을 강력히 권장합니다. json 버전을 업그레이드할 수 없는 사용자를 위해, 이 gemjsoncve202010663은 사용자의 json 버전을 CVE-2020-10663에 대해 monkey-patch합니다. 현재 버전의...

Detection-and-Mitigation-script-for-CVE-2021-42717

Detection-and-Mitigation-script-for-CVE-2021-42717 CVE-2021-42717 탐지 및 완화 스크립트 - JSON 파싱의 ModSecurity DoS 취약점 ModSecurity 3.x3.0.5는 과도하게 중첩된 JSON 객체를 잘못 처리합니다. 수만 단계 깊이로 중첩된 조작된 JSON 객체는 웹 서버가 정상적인 요청을 처리하지 못하게 만들 수 있습니다. 적당히 큰예: 300KB HTTP 요청조차도 제한된 NGINX 워커 프로세스 중 하나를 수 분 동안 점유하여 머신에서 사용 가능한 CP...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase 인증되지 않은 NoSQL 연산자 삽입 Budibase에서 인증되지 않은 JSON/NoSQL 연산자 삽입 취약점. 문서 데이터 소스MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, 또는 JSON 본문이 있는 REST를 기반으로 하는 PUBLIC 쿼리를 노출하는 게시된 Budibase 앱의 모든 익명 방문자는 백업 컬렉션의 모든 문서를 읽을 수 있으며 , 공개 쓰기 쿼리가 존재하는 경우 단일 인증되지 않은 HTTP 요청으로 모든 문서를 수정할 ...

crack-0.1.8-fixed

= crack Really simple JSON and XML parsing, ripped from Merb and Rails. The XML parser is ripped from Merb and the JSON parser is ripped from Rails. I take no credit, just packaged them for all to enjoy and easily use. == 릴리즈에 관한 참고사항 릴리즈는 GitHub에 태그되며, GitHub와 RubyForge에 gem으로 배포됩니다. Master 브랜치는...

couchdb-exploit

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 Apache CouchDB - Privilege Escalation & Remote Code Execution 📖 Overview This tool exploits two critical vulnerabilities in Apache CouchDB: CVE| Description| Severity ---|---|--- CVE-2017-12635| Privilege Escalation via JSON Parsing Bypass| 🔴...

CVE-2022-33171

CVE-2022-33171: TypeORM SQL 주입 참고: 이 문서는 CVE-2022-33171에 대한 진행 중인 분석입니다. 여기에 제공된 세부 사항은 추가 정보가 제공됨에 따라 업데이트될 수 있습니다.현재 작동하지 않음 취약점 세부 정보 CVE ID: CVE-2022-33171 제품: TypeORM 영향 받는 버전: 0.3.0 취약점 유형: SQL Injection 공개 날짜: June 28, 2022 설명 TypeORM 0.3.0 이전 버전의 findOneid 및 findOneOrFailid 함수는 문자열 또는...

CVE-2026-104183

A flaw was found in stream-json. When parsing JSON data, the Assembler component directly assigns properties, allowing an input key named 'proto' to replace a parsed object's internal prototype rather than creating a standard property. An attacker who supplies crafted input can exploit this...

CVE-2026-0915-json-Patch.-V2.0

CVE-2026-0915-json-Patch.-V2.0 バグを修正 - glibc 🔒 JSONバリデータセキュリティパッチ CVE-2026-0915向けエンタープライズグレードのソリューション - 厳格なスキーマ検証による安全でないJSONパースからの保護。 🚨 セキュリティ通知 このパッチはCVE-2026-0915 を修正します - インジェクション攻撃を引き起こす可能性のあるJSONパース実装における重大な脆弱性です。 ✨ 機能 ✅ AJVによる厳格なスキーマ検証 ✅ 自動入力サニタイゼーション ✅ DoS攻撃に対するレート制限 ✅ セキュリティ監視とアラート ✅...

CVE-2026-101101

A flaw was found in ag-ui. A remote authenticated attacker can trigger an uncaught exception during JSON parsing by submitting malformed input to the middleware component. This failure can cause the application to crash unexpectedly, resulting in a Denial of Service DoS. Mitigation Restrict netwo...

PT-2026-104011

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The Assembler component materializes object properties using plain assignment. When an input key is named proto , it invokes the inherited setter, leading to the replacement of the parsed object...

Exposure Of Data Element To Wrong Session

org.apache.struts, struts2-json-plugin is vulnerable to an exposure of data element to wrong session. The vulnerability is due to per-request JSON parsing state being shared across concurrent requests, which allows an attacker to potentially observe data associated with another request and bypass...

Fedora 43 : mongo-c-driver (2026-f74926c622)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f74926c622 advisory. libmongoc 1.30.9 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

GHSA-W4CM-GVHJ-CGW6 Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...

Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...

SUSE CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

PT-2026-95187

Name of the Vulnerable Software and Affected Versions go-openapi/swag jsonutils versions prior to 0.27.1 Description A stack overflow issue exists in ordered JSON parsing and serialization caused by unbounded recursion without a depth limit. Remote unauthenticated attackers can exploit this by...

Fedora 44 : mongo-c-driver (2026-8ed63cce6b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8ed63cce6b advisory. libmongoc 1.30.9 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

Fedora 45 : mongo-c-driver (2026-83792d666c)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-83792d666c advisory. libmongoc 2.5.2 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

SummaryWhile investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies.In the tested...