767 matches found
CVE-2017-18640
CVE-2017-18640 affects SnakeYAML; the vulnerability arises from entity expansion (Billion Laughs style) during load, allowing abuse of the alias feature. Affected versions are before 1.26 (e.g., SnakeYAML 1.25.x onward) with public mentions in multiple advisories showing a fix in 1.26. Fedora/Alm...
PT-2019-5799
Name of the Vulnerable Software and Affected Versions SnakeYAML versions prior to 1.26 Description The issue is related to errors in processing XML entities, which can lead to a denial of service when exploited by a remote attacker. The problem is associated with the Alias feature during a load...
Remote Code Execution (RCE)
RESTEasy is vulnerable to remote code execution. SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy uses SnakeYAML and enables the yaml provider by default, under certain conditions, RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of...
GHSA-HVPR-9CR6-Q5V7 Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization. De-serializing untrusted data can lead to security flaws...
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization. De-serializing untrusted data can lead to security flaws...
Apache Brooklyn Remote Code Execution Vulnerability
Apache Brooklyn is the United States Apache Apache Software Foundation's set of frameworks for deploying and managing distributed applications by monitoring and managing applications. A security vulnerability exists in SnakeYAML in versions of Apache Brooklyn prior to 0.10.0. An attacker could...
CVE-2016-8744
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
CVE-2016-8744
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
Default configuration
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
CVE-2016-8744
CVE-2016-8744 affects Apache Brooklyn. The issue stems from SnakeYAML: in Brooklyn’s default configuration prior to 0.10.0, unmarshal allows any Java type on the classpath. This enables an authenticated user to cause the JVM running Brooklyn to load and execute Java code with the process’s privil...
CVE-2016-8744
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
CVE-2016-8744
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
PT-2017-9776
Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0 Description The issue allows an authenticated user to cause the JVM running Apache Brooklyn to load and run Java code without detection. This could provide access to privileges of the Java process,...
CVE-2016-8744: Deserialization of Untrusted Data
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
camel-snakeyaml: Unmarshalling operation is vulnerable to RCE
It was found that the camel-snakeyaml component is exploitable for code execution. An attacker could use this vulnerability to send specially crafted payload to a camel-snakeyaml endpoint and causing a remote code execution attack...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
CVE-2017-3159
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws...
CVE-2017-3159
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws...