Arbitrary Command Injection

jwutil is vulnerable to arbitrary command injection. The vulnerability exists as it uses the insecure function yaml.load without any validation in FromString and FromStream...

CVE-2017-18342

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

GLSA-202003-45 : PyYAML: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202003-45 PyYAML: Arbitrary code execution It was found that using yaml.load API on untrusted input could lead to arbitrary code execution. Impact : A remote attacker could entice a user to process specially crafted input in an...

Remote Code Execution (RCE)

pyyaml is vulnerable to remote code execution RCE attacks. The application uses the unsafe function yaml.load, allowing a malicious user to inject and execute arbitrary code by passing a yaml file. This vulnerability exists due to an incomplete fix for CVE-2017-18342...

Huawei EulerOS: Security Advisory for PyYAML (EulerOS-SA-2019-2299)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.5.0 : PyYAML (EulerOS-SA-2020-1083)

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - In PyYAML before 4.1, the yaml.load API could execute arbitrary code. In other words, yaml.safeload is not...

Design/Logic Flaw

A flaw was found in the yaml.load function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files...

CVE-2019-10135: Deserialization of Untrusted Data

A flaw was found in the yaml.load function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files...

CVE-2019-10135

A flaw was found in the yaml.load function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files...

CVE-2019-10135

A flaw was found in the yaml.load function in the osbs-client prior to version 0.56.1. Insecure use of the yaml.load function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files...

EulerOS 2.0 SP5 : PyYAML (EulerOS-SA-2019-1041)

According to the version of the PyYAML package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In PyYAML before 4.1, the yaml.load API could execute arbitrary code. In other words, yaml.safeload is not used.CVE-2017-18342 Note that Tenable...

GHSA-PVHP-V9QP-XF5R Django-piston and Django-tastypie do not properly deserialize YAML data

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. Django Tastypie has a very similar vulnerability...

Remote Code Execution (RCE)

pyyaml is vulnerable to remote code execution RCE attacks. The application uses the unsafe function yaml.load, allowing a malicious user to inject and execute arbitrary code by passing a yaml file...

Code injection

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

CVE-2017-18342

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

CVE-2017-18342: Deserialization of Untrusted Data

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

CVE-2018-12565

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load instead of yaml.safeload when parsing user data, remote code execution can occur...

CVE-2018-12565

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load instead of yaml.safeload when parsing user data, remote code execution can occur...

CVE-2018-12565

CVE-2018-12565 affects Linaro LAVA prior to 2018.5.post1. The root cause is parsing user data with yaml.load() instead of yaml.safe_load(), which can enable remote code execution. Documents do not provide a confirmed exploit method or patches within the LAVA project; no explicit remediation versi...

CVE-2018-12565: Improper Input Validation

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load instead of yaml.safeload when parsing user data, remote code execution can occur...