CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38723 – WordPress Get Use APIs – JSON Content Importer plugin <= 1.5.6 - Server Side Request Forgery (SSRF) vulnerability
https://notcve.org/view.php?id=CVE-2024-38723
11 Jul 2024 — Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6. Vulnerabilidad de Server-Side Request Forgery (SSRF) en Bernhard Kux JSON Content Importer. Este problema afecta a JSON Content Importer: desde n/a hasta 1.5.6. The Get Use APIs – JSON Content Importer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.6. This makes it possible for authenticated attac... • https://patchstack.com/database/vulnerability/json-content-importer/wordpress-get-use-apis-json-content-importer-plugin-1-5-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28699
https://notcve.org/view.php?id=CVE-2024-28699
22 Apr 2024 — A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function. Una vulnerabilidad de desbordamiento de búfer en pdf2json v0.70 permite a un atacante local ejecutar código arbitrario a través de las funciones GString::copy() e ImgOutputDev::ImgOutputDev. • http://pdf2json.com • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-51074 – json-path: stack-based buffer overflow in Criteria.parse method
https://notcve.org/view.php?id=CVE-2023-51074
27 Dec 2023 — json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. Se descubrió que json-path v2.8.0 contenía un desbordamiento de pila mediante el método Criteria.parse(). A stack overflow vulnerability was found in the Criteria.parse() method in json-path. This issue occurs due to an uncontrolled recursion caused by specially crafted input, leading to a stack overflow. This vulnerability has the potential to trigger a crash, resulting in a denial of service. • https://github.com/json-path/JsonPath/issues/973 • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51774
https://notcve.org/view.php?id=CVE-2023-51774
25 Dec 2023 — The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode. La gema json-jwt (también conocida como JSON::JWT) 1.16.3 para Ruby a veces permite eludir los controles de identidad mediante un ataque de confusión de signo/cifrado. Por ejemplo, a veces se puede utilizar JWE para omitir JSON::JWT.decode. • https://github.com/P3ngu1nW/CVE_Request/blob/main/novjson-jwt.md • CWE-284: Improper Access Control •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6268 – JSON Content Importer < 1.5.4 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-6268
04 Dec 2023 — The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento JSON Content Importer WordPress anterior a 1.5.4 no sanitiza ni escapa el parámetro de pestaña antes de devolverlo a la página, lo que genera Cross-Site Scripting Reflejado que podría usarse contra usuarios con privilegios elevados, como el adminis... • https://wpscan.com/vulnerability/15b9ab48-c038-4f2e-b823-1e374baae985 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5072 – DoS Vulnerability in JSON-Java
https://notcve.org/view.php?id=CVE-2023-5072
12 Oct 2023 — Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. Denegación de Servicio (DoS) en versiones JSON-Java hasta 20230618 incluida. Un error en el analizador significa que una cadena de entrada de tamaño modesto puede provocar el uso de cantidades indefinidas de memoria. A flaw was found in the org.json package. • http://www.openwall.com/lists/oss-security/2023/12/13/4 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32292 – Ubuntu Security Notice USN-6310-1
https://notcve.org/view.php?id=CVE-2021-32292
22 Aug 2023 — An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit. Se descubrió un problema en json-c desde 20200420 (post 0.14 código no publicado) hasta 0.15-20200726. Existe un Desbordamiento de Búfer en el programa de ejemplo auxiliar json_parse que se encuentra en el análisis de funciones. It was discovered that json-c incorrectly handled certain JSON files... • https://github.com/json-c/json-c/issues/654 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34612
https://notcve.org/view.php?id=CVE-2023-34612
14 Jun 2023 — An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. • https://github.com/phax/ph-commons/issues/35 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34610
https://notcve.org/view.php?id=CVE-2023-34610
14 Jun 2023 — An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. • https://github.com/jdereg/json-io/issues/169 • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27849
https://notcve.org/view.php?id=CVE-2023-27849
24 Apr 2023 — rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. • https://github.com/omnitaint/Vulnerability-Reports/blob/2211ea4712f24d20b7f223fb737910fdfb041edb/reports/rails-routes-to-json/report.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •