84 matches found
CVE-2022-45689
hutool-json v5.8.10 was discovered to contain an out of memory error...
CVE-2022-41714
fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...
PT-2022-37383 Ā· Pypi Ā· D8S-JsonĀ +1
Name of the Vulnerable Software and Affected Versions: d8s-json version 0.1.0 Description: The d8s-json package for Python contains a potential code-execution backdoor. This backdoor is attributed to the democritus-strings package, which was inserted by a third party. Recommendations: For version...
PT-2022-24607 Ā· Pypi Ā· Democritus-StringsĀ +1
Name of the Vulnerable Software and Affected Versions: d8s-json version 0.1.0 Description: The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version 0.1.0,...
rubygem-json: Unsafe object creation vulnerability in JSON
A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem including the one bundled with Ruby can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269...
ruby:2.5 security, bug fix, and enhancement update
An update is available for rubygem-bson, rubygem-mysql2, rubygem-bundler, ruby, rubygem-mongo, rubygem-pg, rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
CVE-2021-30468
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...
CVE-2021-31875
In mjsjson.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjsjsonparse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isnāt...
mysql: Server: JSON unspecified vulnerability (CPU Jul 2020)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...
mysql: Server: JSON unspecified vulnerability (CPU Jul 2020)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...
CVE-2020-24355
Zyxel VMG5313-B30B router on firmware 5.13ABCJ.6b31127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during accoun...
Command Injection
json is vulnerable to command injection. The vulnerability exists because it does not sufficiently filter the lookup string argument to the function parseLookup, allowing an attacker to pass malicious commands through it...
Sophos VPN Web Panel 2020 - Denial of Service Exploit
Exploit Title: Sophos VPN Web Panel 2020 - Denial of Service Poc Exploit Author: Berk KIRAS Vendor Homepage: https://www.sophos.com/ Version:2020 Web Panel Tested on: Apache Berk KIRAS PwC - Cyber Security Specialist Sophos VPN Web Portal Denial of Service Vulnerability System parse JSON data. If...
UBUNTU-CVE-2020-14624
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...
Command Injection
json is vulnerable to command injection. The vulnerability exists due to the usage of eval in the parseString function of json.js, allowing a malicious user to inject malicious commands through it...
Moderate: Red Hat Security Advisory: pcs security and bug fix update
An update for pcs is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
SUSE-SU-2020:0995-1 Security update for ruby2.5
This update for ruby2.5 to version 2.5.8 fixes the following issues: - CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON bsc1167244. - CVE-2020-10933: Heap exposure vulnerability in the socket library bsc1168938...
Oracle MySQL Server Denial of Service Vulnerability (CNVD-2018-21477)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: JSON subcomponent of the MySQL Server component in Oracle MySQL, version 8.0.12 and earlier. An attack...
Authorization
An exploitable improper authorization vulnerability exists in minersetGasPrice API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger...
DEBIAN-CVE-2014-4616
Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function...