CVE-2021-23262

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

Security feature bypass

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

CVE-2021-23262 Snakeyaml deserialization vulnerability bypass

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

CVE-2021-23262

The CVE-2021-23262 issue pertains to Crafter CMS. Authentication is required for the attacker to modify the main YAML configuration file and load a Java class, leading to remote code execution. Multiple sources describe this vulnerability as affecting Crafter CMS and enabling an RCE when authenti...

Crafter CMS 安全漏洞

Crafter CMS is an open source content management system CMS for digital experience applications.A code execution vulnerability exists in Crafter CMS, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could modify the main...

CVE-2021-23262

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

Open-xchange OX App Suite Code Injection Vulnerability

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A code injection vulnerability exists in Open-xchange OX App Suite, which can be exploited by attacker...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

Code injection

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493

CVE-2021-33493 pertains to Open-Xchange OX App Suite (OX App Suite/OX Documents) up to version 7.10.5, where the middleware component allows Code Injection via YAML-formatted Java classes. The root cause is the handling of YAML-based Java class definitions in the middleware, enabling an attacker ...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal

Product: OX App Suite, OX Documents Vendor: OX Software GmbH Internal reference: MWB-993 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.5 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev35,...

Kube-Applier - Enables Automated Deployment And Declarative Configuration For Your Kubernetes Cluster

kube-applier is a service that enables continuous deployment of Kubernetes objects by applying declarative configuration files from a Git repository to a Kubernetes cluster. kube-applier runs as a Pod in your cluster and watches the Git repo to ensure that the cluster objects are up-to-date with...

PyYAML: incomplete fix for CVE-2020-1747

A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw...

Nameko Arbitrary code execution due to YAML deserialization

Impact Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example: yaml malicious.yaml !!python/object/new:type args: 'z', !!python/tuple , 'extend': !!python/name:exec listitems: "import'os'.system'cat /etc/passwd'" shell $ nameko run --config...

GHSA-6P52-JR3Q-C94G Nameko Arbitrary code execution due to YAML deserialization

Impact Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example: yaml malicious.yaml !!python/object/new:type args: 'z', !!python/tuple , 'extend': !!python/name:exec listitems: "import'os'.system'cat /etc/passwd'" shell $ nameko run --config...

Remote Code Execution (RCE)

nameko is vulnerable to remote code execution. The use of unsafe deserialising a YAML config file allows an attacker to provide files with malicious content to trigger the attack...