4436 matches found
SUSE CVE-2022-25857
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...
SUSE CVE-2022-32224
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...
SUSE CVE-2022-38749
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow...
SUSE CVE-2022-38751
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow...
SUSE CVE-2022-41854
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack...
Security Bulletin: IBM CICS TX Standard is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function.
Summary IBM CICS TX Standard is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function. The fix removes this vulnerability from IBM CICS TX Standard. Vulnerability Details IBM X-Force ID: 221571 DESCRIPTION: Yaml Go package is vulnerable to a denial ...
Security Bulletin: IBM CICS TX Advanced is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function.
Summary IBM CICS TX Advanced is vulnerable to a denial of service, caused by improper logic in the Yaml Go package decode.go function. The fix removes this vulnerability from IBM CICS TX Advanced. Vulnerability Details IBM X-Force ID: 221571 DESCRIPTION: Yaml Go package is vulnerable to a denial ...
SnakeYaml: Constructor Deserialization Remote Code Execution
A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution RCE...
VulnCheck KEV: CVE-2022-47986
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw...
snakeyaml: Denial of Service due to missing nested depth limitation for collections
A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service DoS due to missing nested depth limitation for collections...
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing
CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. When creating a ConfigMap object which has...
GHSA-74FP-R6JW-H4MP Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing
CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. When creating a ConfigMap object which has...
Ubuntu: Security Advisory (USN-5847-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.2 security update
Red Hat OpenShift Container Platform release 4.12.2 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...
USN-5847-1: Grunt vulnerabilities
It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue to execute arbitrary code. CVE-2020-7729 It was discovered that Grunt was not properly handling symbolic links when performing file copy operations. An attacker could...
USN-5847-1 grunt vulnerabilities
It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue to execute arbitrary code. CVE-2020-7729 It was discovered that Grunt was not properly handling symbolic links when performing file copy operations. An attacker could...
Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : Grunt vulnerabilities (USN-5847-1)
The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5847-1 advisory. It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue t...
Security Bulletin: IBM Cloud Pak for Multicloud Management is vulnerable to denial of service attacks due to snakeYAML
Summary SnakeYAML is used by some components of IBM Cloud Pak for Multicloud Management and it is vulnerable to a denial of service attacks. CVE-2022-25857, CVE-2022-38751, CVE-2022-38752, CVE-2022-38749, CVE-2022-38750 Vulnerability Details CVEID:CVE-2022-25857 DESCRIPTION: Java package...
SUSE: Security Advisory (SUSE-SU-2023:0187-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
