CVE-2021-36162

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

CVE-2021-36162 Unprotected yaml deserialization cause RCE

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

CVE-2021-36162

Apache Dubbo (routing/configuration rules loaded from config centers like Zookeeper or Nacos) is affected by CVE-2021-36162 through unsafe YAML deserialization using SnakeYAML, which can enable arbitrary constructor invocation and remote code execution when consumers retrieve tampered rules. The ...

charleskorn kaml 安全漏洞

charleskorn kaml is an open source implementation of the YAML format that supports kotlinx.serialization. A security vulnerability exists in versions of kaml prior to 0.35.3 that allows an attacker to provide arbitrary YAML input to an application using kaml An attacker could cause the applicatio...

YAML deserialization can run untrusted code

Impact An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An...

GHSA-Q4RF-3FHX-88PF YAML deserialization can run untrusted code

Impact An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An...

Edgegallery developer-be code issue vulnerability

Edgegallery developer-be is a developer platform that provides development tools/testing environment/online deployment for App developers, divided into two parts: developer-be is the backend part, providing interface calls, and developer-fe is the frontend part, providing interface display...

CVE-2021-39132

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

CVE-2021-39132 YAML deserialization can run untrusted code

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

Deserialization of untrusted data

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

CVE-2021-34066

CVE-2021-34066 affects EdgeGallery/developer before v1.0. The issue is a YAML deserialization vulnerability in uploaded YAML files that enables execution of system commands. The impact is high (C/H I/H A/H) with network attack vector and no privileges or user interaction required. The available c...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

Github developer-be 代码问题漏洞

Edgegallery developer-be is a developer platform that provides development tools/testing environment/online deployment for App developers, divided into two parts: developer-be is the backend part, providing interface calls, and developer-fe is the frontend part, providing interface display...

Uncontrolled recursion leads to abort in deserialization

Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth...

GHSA-39VW-QP34-RMWF Uncontrolled recursion leads to abort in deserialization

Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth...

amethyst_config (0.3.0), amqpr (>=0.1.0, <=0.2.2) +147 more potentially affected by unknown CVE via serde_yaml (>=0.6.2, <=0.7.5)

serdeyaml CARGO version =0.6.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.1, =3.1.3, =0.1.0, =0.1.1, =0.2.4, =0.3.1-alpha.2, =0.4.0, =0.4.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-39VW-QP34-RMWF...

Uncontrolled recursion in rust-yaml

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth...

aa2 (>=0.9.0, <=0.9.1), abridge (>=1.0.0, <=1.1.6) +429 more potentially affected by CVE-2018-20993 via yaml-rust (>=0.2.2, <=0.3.5)

yaml-rust CARGO version =0.2.2, =0.9.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.0.0, =0.1.0, =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.3.4 - asuran-cli 0.1.1 and more Source cves: CVE-2018-20993 Source advisory: OSV:GHSA-HV87-47H9-JCVQ...