CVE-2021-23338 Deserialization of Untrusted Data

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

CVE-2021-23338

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

Qlib Security Vulnerabilities

A security vulnerability exists in all versions of qlib that stems from the use of insecure YAML load functions for workflow functions...

Deserialization of Untrusted Data

Amendment This was deemed not a vulnerability. Overview qlib is an A Q Library for Data Scientist Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The workflow function in cli part of qlib was using an unsafe YAML load function. Details Serialization is a...

CVE-2020-7738

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...

UBUNTU-CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

Debian DLA-2357-1 : ros-actionlib security update

Use of unsafe yaml load was fixed in ros-actionlib, the Robot OS actionlib library. For Debian 9 stretch, this problem has been fixed in version 1.11.7-1+deb9u1. We recommend that you upgrade your ros-actionlib packages. For the detailed security status of ros-actionlib please refer to its securi...

[SECURITY] [DLA 2357-1] ros-actionlib security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2357-1 [email protected] https://www.debian.org/lts/security/ August 30, 2020 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package...

CVE-2020-10289

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

CVE-2020-10289

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

CVE-2020-10289

CVE-2020-10289 affects the ROS core package’s actionlib, where an unsafe YAML parsing path in actionlib/tools/library.py:132 allows instantiation of arbitrary Python objects and can enable arbitrary code execution if an action message is processed. The vulnerability arises from using unsafe yaml....

CVE-2020-10289

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

CVE-2020-10289 RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132

Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib...

Arbitrary Code Execution

Overview grunt is a JavaScript task runner. Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML. Remediation Upgrade grunt to version...

Arbitrary Code Execution

Overview shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad. Remediation There is no fixed version for shiba...

Arbitrary Code Execution

Overview jingo is a git based wiki engine written for node.js, with a decent design, a search capability and a good typography. Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function yaml.load of the package js-yaml instead of its...

PT-2019-11591 · Red Hat · Osbs-Client

Name of the Vulnerable Software and Affected Versions: osbs-client versions 0.46 through 0.56.0 Description: A flaw was found in the yaml.load function, allowing insecure use that enables loading of suspicious objects for code execution via parsing of malicious YAML files. Recommendations: For...

Ruby: The taint flag is not propagated at JSON.parse

Vulnerability description not provided...

PYSEC-2018-49

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...

UBUNTU-CVE-2017-18342

In PyYAML before 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function...