CVE-2020-7738

CVE-2020-7738 affects the shiba package. The root cause is the use of js-yaml.load() instead of the secure js-yaml.safeLoad(), enabling Arbitrary Code Execution. Affected: all shiba versions; impact: arbitrary code execution; remediation: Snyk notes no fixed shiba version yet. References include ...

PT-2020-15704 · Cloudflare · Cloudflared

Name of the Vulnerable Software and Affected Versions: cloudflared versions prior to 2020.8.1 Description: The issue allows for local privilege escalation on Windows systems due to the way cloudflared searches for and reads configuration files. This could be exploited by a malicious entity to...

Fedora: Security Advisory for pandoc-citeproc (FEDORA-2020-c39d7a562c)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability of the jw.util package, related to errors in checking the processed YAML files during configuration loading, allows a attacker to execute arbitrary operating system commands.

The vulnerability of the jw.util package is related to errors during the validation of YAML files processed when loading configuration files. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the operating system...

The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

...

An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap HandleMap HandleFlowSequence HandleSequence HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file.

...

The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

...

The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

...

Fedora 32 : php-symfony4 (2020-16eb328853)

Version 4.4.13 2020-09-02 - security CVE-2020-15094 Remove headers with internal meaning from HttpClient responses mpdude - bug 38024 Console Fix undefined index for inconsistent command name definition chalasr - bug 38023 DI fix inlining of non-shared services nicolas-grekas - bug 38020...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.0.13 or later...

Debian DLA-2368-1 : grunt security update

It was discovered that there was a arbitrary code execution vulnerability in grunt, a JavaScript task runner. This was possible due to the unsafe loading of YAML documents. For Debian 9 'Stretch', this problem has been fixed in version 1.0.1-5+deb9u1. We recommend that you upgrade your grunt...

Debian: Security Advisory (DLA-2368-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-6292 affecting package yaml-cpp 0.6.2-6

CVE-2019-6292 affecting package yaml-cpp 0.6.2-6. A patched version of the package is available...

CVE-2018-20573 affecting package yaml-cpp 0.6.2-6

CVE-2018-20573 affecting package yaml-cpp 0.6.2-6. A patched version of the package is available...

CVE-2019-6285 affecting package yaml-cpp 0.6.2-6

CVE-2019-6285 affecting package yaml-cpp 0.6.2-6. A patched version of the package is available...

CVE-2018-20574 affecting package yaml-cpp 0.6.2-6

CVE-2018-20574 affecting package yaml-cpp 0.6.2-6. A patched version of the package is available...

EulerOS Virtualization for ARM 64 3.0.2.0 : PyYAML (EulerOS-SA-2020-1948)

According to the versions of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary cod...

DEBIAN-CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...