CVSS: 9.8EPSS: 19%CPEs: 1EXPL: 2CVE-2021-23509 – Prototype Pollution
https://notcve.org/view.php?id=CVE-2021-23509
This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays. Esto afecta al paquete json-ptr versiones anteriores a 3.0.0. Una vulnerabilidad de confusión de tipo puede conllevar a una omisión de CVE-2020-7766 cuando las claves proporcionadas por el usuario usadas en el parámetro pointer son matrices • https://github.com/flitbit/json-ptr%23security-vulnerabilities-resolved https://github.com/flitbit/json-ptr/commit/5dc458fbad1c382a2e3ca6d62e66ede3d92849ca https://github.com/flitbit/json-ptr/pull/42 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1767165 https://snyk.io/vuln/SNYK-JS-JSONPTR-1577291 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2021-31684 – json-smart: Denial of Service in JSONParserByteArray function
https://notcve.org/view.php?id=CVE-2021-31684
A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request. Se ha detectado una vulnerabilidad en la función indexOf de JSONParserByteArray en versiones 1.3 y 2.4 de JSON Smart que causa una Denegación de Servicio (DOS) por medio de una petición web diseñada A flaw was found in the json-smart package in the JSONParserByteArray. This flaw allows an attacker to cause a denial of service. • https://github.com/netplex/json-smart-v1/issues/10 https://github.com/netplex/json-smart-v1/pull/11 https://github.com/netplex/json-smart-v2/issues/67 https://github.com/netplex/json-smart-v2/pull/68 https://lists.debian.org/debian-lts-announce/2023/03/msg00030.html https://security.netapp.com/advisory/ntap-20240621-0006 https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security/cve/C • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2018-1107 – nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format
https://notcve.org/view.php?id=CVE-2018-1107
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated. Se detectó que la biblioteca de JavaScript is-my-json-valid usaba una expresión regular ineficiente para comprobar los campos JSON definidos para tener formato de correo electrónico. Un archivo JSON especialmente diseñado podría hacer que consuma una cantidad excesiva de tiempo de CPU cuando se comprueba. • https://bugzilla.redhat.com/show_bug.cgi?id=1546357 https://snyk.io/vuln/npm:is-my-json-valid:20180214 https://access.redhat.com/security/cve/CVE-2018-1107 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 1%CPEs: 13EXPL: 2CVE-2021-27568 – json-smart: uncaught exception may lead to crash or information disclosure
https://notcve.org/view.php?id=CVE-2021-27568
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information. Se detectó un problema en netplex json-smart-v1 hasta el 23-10-2015 y json-smart-v2 hasta 2.4. Una excepción es lanzada desde una función, pero no es detectada, como es demostrado por la función NumberFormatException. • https://github.com/netplex/json-smart-v1/issues/7 https://github.com/netplex/json-smart-v2/issues/60 https://lists.apache.org/thread.html/rb6287f5aa628c8d9af52b5401ec6cc51b6fc28ab20d318943453e396%40%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa%40%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/rf70210b4d63191c0bfb2a0d5745e104484e71703bf5ad9cb01c980c6%40%3Ccommits.druid.apache.org%3E https://www.oracle.com//security-alerts/cpujul2021.html https:/&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-20001
https://notcve.org/view.php?id=CVE-2016-20001
The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. El proyecto REST/JSON versiones 7.x-1.x para Drupal, permite un desvío de acceso al nodo, también se conoce como SA-CONTRIB-2016-033. NOTA: Este proyecto no está cubierto por la política de avisos de seguridad de Drupal. • https://www.drupal.org/node/2744889 • CWE-863: Incorrect Authorization •