180 matches found
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to SnakeYaml code execution (CVE-2022-1471)
Summary Potential code execution vulnerability in snakeYAML-CVE-2022-1471 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote...
Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 2.13.7 release and security update
An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...
Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2022:9058)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:9058 advisory. - SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can...
RHEL 8 : prometheus-jmx-exporter (RHSA-2022:9058)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:9058 advisory. Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security...
AlmaLinux 8 : prometheus-jmx-exporter (ALSA-2022:9058)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:9058 advisory. - SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can le...
Kubernetes: The `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAML
A code execution vulnerability was found in the io.kubernetes.client.util.generic.dynamic.Dynamics class of the Kubernetes Java Client version 17.0.0. The vulnerability was due to the use of SnakeYAML parser without safe constructor, which allowed an attacker to achieve code execution inside the...
prometheus-jmx-exporter security update
An update is available for prometheus-jmx-exporter. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Prometheus JMX Exporter is a JMX to Prometheus exporter: a...
Important: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.3.4 security update
An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...
prometheus-jmx-exporter security update
0.12.0-9 - Fix CVE-2022-1471 by using SafeConstructor...
Oracle Linux 8 : ELSA-2022-9058-1: / prometheus-jmx-exporter (ELSA-2022-90581)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-90581 advisory. 0.12.0-9 - Fix CVE-2022-1471 by using SafeConstructor. Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...
ALSA-2022:9058 Important: prometheus-jmx-exporter security update
Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-1471 For more details about the security issues, including the impact, a...
au.com.ninthavenue.jamaica.faces:novdl (=1.0), biz.massive-dynamics:Sourcery (=1.0.0.0) +1204 more potentially affected by CVE-2022-1471 via org.yaml:snakeyaml (>=1.4 <=1.9)
org.yaml:snakeyaml MAVEN version =1.4, =1.0.1, =1.1, =4.4-23, =0.1.0, =0.2.2, =0.1.0, =1.0.0, =0.1.10, =0.1.16 and more Source cves: CVE-2022-1471 Source advisory: OSV:GHSA-MJMJ-J48Q-9WG2...
GHSA-MJMJ-J48Q-9WG2 SnakeYaml Constructor Deserialization Remote Code Execution
Summary SnakeYaml's Constructor class, which inherits from SafeConstructor, allows any type be deserialized given the following line: new Yamlnew ConstructorTestDataClass.class.loadyamlContent; Types do not have to match the types of properties in the target class. A ConstructorException is throw...
CVE-2022-1471 vulnerabilities
Vulnerabilities for packages: metric-collector-for-apache-cassandra-4.1, cassandra-reaper, s3proxy, management-api-for-apache-cassandra-5.0, s3proxy-fips, management-api-for-apache-cassandra-4.1, metric-collector-for-apache-cassandra-4.0, management-api-for-apache-cassandra-4.0...
CVE-2022-1471 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, management-api-for-apache-cassandra-5.0, metric-collector-for-apache-cassandra-4.1...
DEBIAN-CVE-2022-1471
SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. ...
CVE-2022-1471
SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. ...
CVE-2022-1471
CVE-2022-1471 is caused by SnakeYAML deserialization allowing remote code execution. At Atlassian Data Center/Server products (e.g., Jira Core/Jira Software/Data Center and Server, Confluence Data Center/Server, Bitbucket Data Center/Server) multiple versions were affected due to the SnakeYAML un...
CVE-2022-1471
creationtimestamp| type| source ---|---|--- 2022-10-13 17:30:29+00:00| published-proof-of-concept| https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2 2022-12-01 14:30:28+00:00| seen| https://t.me/cibsecurity/53754 2023-10-09 21:14:14+00:00| seen|...