4539 matches found
PYSEC-2021-848
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...
CVE-2021-43811 Code injection via unsafe YAML loading
Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...
CVE-2021-43811
Sockeye (PyTorch-based) vulnerable to code execution via unsafe YAML loading in model/data config files when using versions below 2.3.24; an attacker can inject malicious config, which executes locally when a user runs the model. The issue is fixed in 2.3.24. Practical impact is limited to users ...
CVE-2021-41090 Instance config inline secret exposure
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...
Sockeye 代码注入漏洞
Sockeye is an open source sequence-to-sequence framework for neural machine translation based on PyTorch. Sockeye suffers from a code injection vulnerability that stems from Sockeye's use of YAML to store model and data configurations on disk.Versions of Sockeye up to 2.3.24 are loaded using...
Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments
Swurg is a Burp Suite extension designed for OpenAPI testing. The OpenAPI Specification OAS defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring acce...
Crafter CMS Code Execution Vulnerability
Crafter CMS is an open source content management system CMS for digital experience applications.A code execution vulnerability exists in Crafter CMS, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could modify the main...
CVE-2021-23262
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
CVE-2021-23262
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
Security feature bypass
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
CVE-2021-23262 Snakeyaml deserialization vulnerability bypass
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
CVE-2021-23262
The CVE-2021-23262 issue pertains to Crafter CMS. Authentication is required for the attacker to modify the main YAML configuration file and load a Java class, leading to remote code execution. Multiple sources describe this vulnerability as affecting Crafter CMS and enabling an RCE when authenti...
Crafter CMS 安全漏洞
Crafter CMS is an open source content management system CMS for digital experience applications.A code execution vulnerability exists in Crafter CMS, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could modify the main...
CVE-2021-23262
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
Whispers - Identify Hardcoded Secrets In Static Structured Text
"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...
Open-xchange OX App Suite Code Injection Vulnerability
Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A code injection vulnerability exists in Open-xchange OX App Suite, which can be exploited by attacker...
CVE-2021-33493
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
CVE-2021-33493
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...