SUSE SLES12 Security Update : slurm_20_11 (SUSE-SU-2021:1791-1)

This update for slurm2011 fixes the following issues : Udpate to 20.11.7 : CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling bsc1186024 Ship REST API version and auth plugins with slurmrestd. Add YAML support...

CVE-2021-30180 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

CVE-2021-30180

CVE-2021-30180 — Apache Dubbo : Affects Dubbo versions prior to 2.7.9. The vulnerability arises when parsing YAML tag routing rules, which may allow a client to trigger calling arbitrary constructors on the server. This is the underlying root cause described in the initial details. Potential impa...

SUSE-SU-2021:1793-1 Security update for slurm_20_11

This update for slurm2011 fixes the following issues: - Udpate to 20.11.7: - CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling bsc1186024 - Ship REST API version and auth plugins with slurmrestd. - Add YAML...

SUSE-SU-2021:1791-1 Security update for slurm_20_11

This update for slurm2011 fixes the following issues: - Udpate to 20.11.7: - CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling bsc1186024 - Ship REST API version and auth plugins with slurmrestd. - Add YAML...

CVE-2021-29503

HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend...

CVE-2021-29503

HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend...

Cross site scripting

HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend...

CVE-2021-29503 Improper Neutralization of Script-Related HTML Tags in Notes

HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend...

CVE-2021-29503

HedgeDoc before 1.8.2 is vulnerable to XSS via YAML-metadata in notes. An attacker with write access can embed HTML in Open Graph metadata, causing the frontend to render a script tag in the head; unauthenticated edits possible if guests can edit, otherwise authenticated users with write access c...

Arbitrary Code Execution

kubernetes java client is vulnerable to arbitrary code execution. An attacker is able to execute arbtirary code on the host OS by loading malicious YAML files...

CVE-2021-25738

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution...

GHSA-PMQP-H87C-MR78 XML Entity Expansion and Improper Input Validation in Kubernetes API server

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming...

EulerOS 2.0 SP5 : PyYAML (EulerOS-SA-2021-1912)

According to the version of the PyYAML package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes...

Google Kubernetes 代码问题漏洞

Google Kubernetes is a set of open source Docker container cluster management system from the U.S. company Google Google. The system provides resource scheduling, deployment and operation, service discovery and scaling up and down for containerized applications. A code issue vulnerability exists ...

Ubuntu 20.04 LTS : PyYAML vulnerability (USN-4940-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4940-1 advisory. It was discovered that PyYAML incorrectly handled untrusted YAML files with the FullLoader loader. A remote attacker could possibly use this issue to execute...

Ubuntu: Security Advisory (USN-4940-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-JVF4-G24P-2QGW Arbitrary Code Execution in shiba

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...

Arbitrary Code Execution in shiba

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...