Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
json vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2021-32292
An issue exists in json-c from 20200420 (post 0.14 unreleased code) up to and including 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
Json-c Project Json-c 0.15-20200726
6.1
CVSSv3
CVE-2022-30241
The jquery.json-viewer library up to and including 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.
Jquery Json-viewer Project Jquery Json-viewer
5.3
CVSSv3
CVE-2019-19507
In jpv (aka Json Pattern Validator) prior to 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a c...
Json Pattern Validator Project Json Pattern Validator
7.5
CVSSv3
CVE-2021-31684
A vulnerability exists in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.
Json-smart Project Json-smart-v1
Json-smart Project Json-smart-v2
Oracle Utilities Framework 4.4.0.0.0
Oracle Utilities Framework 4.4.0.2.0
Oracle Utilities Framework 4.4.0.3.0
7.5
CVSSv3
CVE-2022-45688
A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows malicious users to cause a Denial of Service (DoS) via crafted JSON or XML data.
Hutool Hutool 5.8.10
Json-java Project Json-java
10 Github repositories
5.3
CVSSv3
CVE-2022-41714
fastest-json-copy version 1.0.1 allows an external malicious user to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
Fastest-json-copy Project Fastest-json-copy 1.0.1
5.3
CVSSv3
CVE-2022-42743
deep-parse-json version 1.0.2 allows an external malicious user to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
Deep-parse-json Project Deep-parse-json 1.0.2
9.8
CVSSv3
CVE-2021-4329
A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is...
Json-logic-js Project Json-logic-js 2.0.0
7.5
CVSSv3
CVE-2019-18848
The json-jwt gem prior to 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Json-jwt Project Json-jwt
Debian Debian Linux 9.0
7.5
CVSSv3
CVE-2016-2537
The is-my-json-valid package prior to 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote malicious users to cause a denial of service (blocked event loop) via a crafted string.
Is My Json Valid Project Is My Json Valid
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
remote code execution
CVE-2024-34909
CVE-2024-3317
SSTI
CVE-2024-3400
CVE-2024-30051
wireless
CVE-2024-4622
CVE-2024-4908
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »