GHSA-Q729-696Q-G9PQ SurrealDB has Denial of Service in JSON parser due to nested objects

The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when parsing nested , , or tokens. The expression parser already enforced the limit for these tokens; the value/JSON parser omitted it. An unauthenticated attacker could send a deeply nested JSON payload to t...

Denial Of Service (DoS)

qs is vulnerable to Denial of Service DoS. The vulnerability is due to parseArrayValue returning val.split',' before enforcing arrayLimit, allowing attackers to supply a comma-heavy parameter that creates arbitrarily large arrays in memory without triggering throwOnLimitExceeded, leading to...

PT-2023-35776 · Git +1 · Systemd

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash occurred due to an unknown read issue, as reported by OSS-Fuzz. The crash involves the udev rule parse value function and is related to the...

SUSE CVE-2015-5522

Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service crash via vectors involving a command character in an href...

PT-2021-12016

Name of the Vulnerable Software and Affected Versions: Cesanta MJS version 1.20.1 Description: The issue is a stack overflow vulnerability in the parse value function, which allows remote attackers to cause a Denial of Service DoS via a crafted file. Recommendations: For Cesanta MJS version 1.20....

Cesanta MJS 缓冲区错误漏洞

Cesanta MJS is an embedded JavaScript engine for C/C++, designed for microcontrollers with limited resources. A stack overflow vulnerability exists in parsevalue in Cesanta MJS version 1.20.1. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service...

PT-2020-21739

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions readstat convert, sas7bcat parse value labels, and sas7bcat parse...

PT-2020-22508

Name of the Vulnerable Software and Affected Versions Sass affected versions not specified Description The issue is related to a heap-buffer-overflow read, which occurs in the Sass::Prelexer::quoted string function. This function is called by Sass::Parser::lex and Sass::Parser::parse value schema...

UBUNTU-CVE-2015-5522

Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service crash via vectors involving a command character in an href...