4486 matches found
PT-2023-19712 · Esoteric · Esoteric Yamlbeans
Name of the Vulnerable Software and Affected Versions: Esoteric YamlBeans versions through 1.15 Description: An issue was discovered in Esoteric YamlBeans where a crafted YAML document can perform an XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAM...
YamlBeans 代码问题漏洞
YamlBeans is an open source library from Esoteric Software. Can be easily Java object graph with YAML. A security vulnerability exists in Esoteric Software YamlBeans 1.15 and earlier versions, which stems from the ability of a carefully crafted YAML document to perform an XML entity expansion...
CVE-2023-24621
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed...
CVE-2023-24620
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...
CVE-2023-24621
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed...
CVE-2023-24620
Esoteric YamlBeans (1.15 and earlier) contains a YAMLReader XML Entity Expansion vulnerability. A crafted YAML document exploits the YAML Anchor feature, allowing small inputs to expand to large sizes and trigger high CPU/memory usage, including Java OOMs. Connected sources corroborate the issue ...
CVE-2023-24621
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed...
CVE-2023-4066
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker...
Arbitrary Code Execution
com.alibaba.nacos:nacos-spring-context is vulnerable to Arbitrary Code Execution. The vulnerability exists in the SnakeYamls Constructor, which is used to parse YAML files. An attacker who is able to modify a yaml file thats defined in the NacosPropertySource is able to execute arbitrary code...
USN-6287-1: Go yaml vulnerabilities
Simon Ferquel discovered that the Go yaml package incorrectly handled certain YAML documents. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause the system to crash, resulting in a denial of service...
USN-6287-1 golang-yaml.v2 vulnerabilities
Simon Ferquel discovered that the Go yaml package incorrectly handled certain YAML documents. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause the system to crash, resulting in a denial of service...
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Go yaml vulnerabilities (USN-6287-1)
The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6287-1 advisory. Simon Ferquel discovered that the Go yaml package incorrectly handled certain YAML documents. If a user or an automated system we...
OESA-2023-1503 snakeyaml security update
SnakeYAML is a YAML parser and emitter for the Java Virtual Machine. YAML is a data serialization format designed for human readability and interaction with scripting languages. Security Fixes: Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS...
Code Injection
boofcv-io is vulnerable to Code Injection. The vulnerability exists because the createYmlObject function of CalibrationIO.java does not properly set the code point limit for the yaml parser, which allows an attacker to inject and execute malicious code by loading a maliciously crafted camera...
Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities
Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...
CVE-2021-31680
Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file...
CVE-2021-31681
Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file...
CVE-2021-31681
Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file...
