4545 matches found
CVE-2023-51389
CVE-2023-51389 affects Hertzbeat, a real-time monitoring system. The vulnerability resides at the /define/yml interface, where SnakeYAML is used to parse YAML without a security configuration, enabling YAML deserialization. Affects versions prior to 1.4.1; version 1.4.1 fixes the issue. The issue...
PT-2024-14104 · Snakeyaml +1 · Snakeyaml +1
Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is a real-time monitoring system. At the interface of "/define/yml", SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML...
Hertzbeat Security Vulnerabilities
Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat versions prior to 1.4.1, which stems from the use of SnakeYAML as a parser to parse yml content at the /define/yml interface, but does not use a secure configuration...
CVE-2024-26147 Helm's Missing YAML Content Leads To Panic
Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would...
CVE-2024-25196
Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions were discovered to contain a buffer overflow via the nav2controller process. This vulnerability is triggerd via sending a crafted .yaml file...
CVE-2024-25196
Open Robotics ROS 2 and Nav2 humble contain a buffer overflow in the nav2_controller process, triggerable by a crafted YAML file. Affected components: ROS 2, Nav2 (humble); root cause: uncontrolled memory handling in nav2_controller. Impact per sources: potential crash/denial by exploitation of Y...
Nav2 Security Vulnerability
Nav2 is a navigation framework and system for ROS2. A security vulnerability exists in Nav2 that stems from a buffer overflow that can be caused by sending a carefully crafted yaml file...
CVE-2024-25196
Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions were discovered to contain a buffer overflow via the nav2controller process. This vulnerability is triggerd via sending a crafted .yaml file...
CVE-2024-25196
Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions were discovered to contain a buffer overflow via the nav2controller process. This vulnerability is triggerd via sending a crafted .yaml file...
PT-2024-20808 · Open Robotics · Ros2 +1
Name of the Vulnerable Software and Affected Versions: Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions Description: A buffer overflow issue was discovered in the nav2 controller process, which can be triggered by sending a crafted .yaml file. Recommendations: For Open...
snakeyaml: Denial of Service due to missing nested depth limitation for collections
A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service DoS due to missing nested depth limitation for collections...
The vulnerability of the YamlProvider component in the RESTEasy software framework allows a perpetrator to execute arbitrary code.
The vulnerability of the YamlProvider component in the RESTEasy software framework is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
Low: snakeyaml
Issue Overview: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-38752 Affected Packages: snakeyaml Note: Th...
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to YAML denial of service vulnerabilitiy [CVE-2023-2251]
Summary Potential YAML denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-2251 Vulnerability Details CVEID:CVE-2023-2251 DESCRIPTION: YA...
Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from go-yaml, OpenSSL, GnuTLS , OpenTelemetry-Go, go-toolset and urllib3
Summary OpenSSL, go-yaml, GnuTLS , OpenTelemetry-Go and urllib3 are consumed through RedHat UBI, go-toolset and OSE packages. These packages are shipped with IBM MQ Operator and IBM supplied MQ Advanced container images. Vulnerability Details CVEID:CVE-2022-28948 DESCRIPTION: Go-Yaml is vulnerabl...
Arbitrary Code Execution
llama-hub is vulnerable to Arbitrary Code Execution. The vulnerability is due to missing safeload configuration during YAML parsing. An attackers can execute arbitrary code by exploiting this vulnerability...
Remote Code Execution (RCE)
Embedchain is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure usage of yaml.load within the loaddata function of openapi.py, allowing an attacker to execute arbitrary code by supplying a crafted YAML file...
Unsafe yaml deserialization in llama-hub
The OpenAPI and ChatGPT plugin loaders in LlamaHub aka llama-hub before 0.0.67 allow attackers to execute arbitrary code because safeload is not used for YAML...
GHSA-297X-2QF3-JRJ3 Unsafe yaml deserialization in llama-hub
The OpenAPI and ChatGPT plugin loaders in LlamaHub aka llama-hub before 0.0.67 allow attackers to execute arbitrary code because safeload is not used for YAML...