WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product json-c✕
Overview 6 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
6matches 1in Waratek scope16.7% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 16.7% Outside Waratek scope 1 16.7% Not applicable 4 66.7% Withdrawn CVE 0 0.0%
Critical 1 16.7% High 2 33.3% Medium 3 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 3 50.0% Forecast only 0 0.0% No public exploit 3 50.0%
split by peak 2 / year
Not applicable: 4Outside Waratek scope: 1No exploit published: 1 Medium: 3High: 2Critical: 1 not blocked: 6 No public exploit: 3Proof of concept only: 3
20142 Not applicable2 Medium2 not blocked2 No public exploit2 20150 20160 20170 20180 20190 20201 Not applicable1 High1 not blocked1 No public exploit1 20210 20221 Not applicable1 Medium1 not blocked1 Proof of concept only1 20231 Outside Waratek scope1 Critical1 not blocked1 Proof of concept only1 20240 20250 20261 No exploit published1 High1 not blocked1 Proof of concept only1
2014201620182020202220242026
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-33013 High 2026-03-20 No exploit published Proof of concept only Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.
CVE-2021-32292 Critical 2023-08-22 Outside Waratek scope Proof of concept only An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
CVE-2022-41714 Medium 2022-11-03 Not applicable Proof of concept only fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
CVE-2020-12762 High 2020-05-09 Not applicable No public exploit json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.
CVE-2013-6371 Medium 2014-04-22 Not applicable No public exploit The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
CVE-2013-6370 Medium 2014-04-22 Not applicable No public exploit Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.