PT-2019-18073 · Yaml Cpp +2 · Yaml-Cpp +2

Name of the Vulnerable Software and Affected Versions: yaml-cpp version 0.6.2 Description: The issue allows remote attackers to cause a denial of service, resulting in stack consumption and application crash, via a crafted YAML file. This is due to a problem in the...

yaml-cpp denial of service vulnerability (CNVD-2019-03333)

yaml-cpp aka LibYaml-C++ is a C++ parser for use in YAML. A denial of service vulnerability exists in the 'SingleDocParser::HandleFlowMap' function in yaml-cpp version 0.6.2. A remote attacker can exploit this vulnerability to cause a denial of service stack consumption and application crash with...

yaml-cpp denial of service vulnerability (CNVD-2019-03332)

yaml-cpp aka LibYaml-C++ is a C++ parser for use in YAML. A denial of service vulnerability exists in the 'Scanner::EnsureTokensInQueue' function in yaml-cpp version 0.6.2. A remote attacker can exploit this vulnerability to cause a denial of service stack consumption and application crash with t...

AZL-7007 CVE-2018-20574 affecting package yaml-cpp for versions less than 0.6.2-6

The SingleDocParser::HandleFlowMap function in yaml-cpp aka LibYaml-C++ 0.6.2 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

CVE-2018-20574

CVE-2018-20574 affects yaml-cpp (LibYaml-C++) 0.6.2, where the function SingleDocParser::HandleFlowMap can be abused by a crafted YAML file to trigger denial of service (stack consumption and application crash). Public documents corroborate this by listing CVE-2018-20574 in SUSE/openSUSE advisori...

CVE-2018-20574

The SingleDocParser::HandleFlowMap function in yaml-cpp aka LibYaml-C++ 0.6.2 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

Steve Pallen Xain Cross-Site Scripting Vulnerability

Steve Pallen Xain is a library that provides HTML markup for Elixir. A cross-site scripting vulnerability exists in versions of Steve Pallen Xain prior to 0.6.2, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'order' parameter...

CVE-2018-20302

An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter...

CVE-2018-20302

An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter...

CVE-2018-20302

An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter...

Agentejo Cockpit Cross-Site Request Forgery Vulnerability

Agentejo Cockpit is a management system for managing structured content on websites. A cross-site request forgery vulnerability exists in Agentejo Cockpit version 0.6.2. A remote attacker can use this vulnerability to perform unauthorized actions e.g., change API tokens and passwords...

Agentejo Cockpit Directory Traversal Vulnerability

Agentejo Cockpit is a management system for managing structured content on websites. A directory traversal vulnerability exists in Agentejo Cockpit version 0.6.2, which arises from a program that does not properly validate a file before performing operations on it. An attacker can exploit the...

Agentejo Cockpit Cross-Site Scripting Vulnerability

Agentejo Cockpit is a management system for managing structured content on websites. A cross-site scripting vulnerability exists in Agentejo Cockpit version 0.6.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cockpit CMS CSRF / XSS / Path Traversal Vulnerabilities

Cockpit CMS suffers from cross site request forgery, cross site scripting, and traversal vulnerabilities. Version 0.6.2 should address these issues. 1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via reques...

Cockpit CMS CSRF / XSS / Path Traversal

1 Path Traversal CVE-2018-15540 It is possible to read/write/delete files or list directories by using "../" to traverse to other folders via requests to /cockpit/media/api Example of a vulnerable request: POST /cockpit/media/api HTTP/1.1 Host: 192.168.5.129 User-Agent: Mozilla/5.0 Windows NT 10....

Cross site scripting

wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page...

WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)

WityCMS 0.6.2 - Cross-Site Request Forgery Password Change input type="hidden" name="groupe"...

WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change) Vulnerability

Exploit for php platform in category web applications i...

WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)

input type="hidden" name="type" value=...

Design/Logic Flaw

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to...