msgpackr's conversion of property names to strings can trigger infinite recursion

Impact When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. Patches The fix is available in v1.10.1 Workarounds Exploits seem to require structured cloning, replacing the 0x70 extension with your own that...

CVE-2023-52079

CVE-2023-52079 concerns msgpackr (NodeJS/JavaScript) before version 1.10.1. When decoding user-supplied MessagePack messages, the decoder can get stuck in a loop, tying up threads. The issue is associated with how certain extensions (e.g., 0x70) may be processed; a mitigation path involves replac...

Remote Code Execution (RCE)

org.skyscreamer:nevado-jms is vulnerable to Remote Code Execution RCE. Lack of proper checking for user supplied messages allows an attacker to upload and execute malicious code on the system via maliciously crafted messages...

Cross-site Scripting(XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The attacks exist because message/lib.php does not sanitize the user-supplied messages properly...

Microsoft Windows Kernel CSRSS Local Privilege Escalation Vulnerability

Description A local privilege-escalation vulnerability affects Microsoft Windows because the kernel fails to properly handle user-supplied messages. A local attacker may leverage this issue to completely compromise the computer. Technologies Affected Microsoft Windows 2000 Advanced Server Microso...