CVE-2021-23338

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

PYSEC-2021-86

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

Code injection

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

PYSEC-2021-86

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

CVE-2021-23338

CVE-2021-23338 affects all versions of the qlib package. The CLI workflow function uses an unsafe YAML load, enabling Deserialization of Untrusted Data. There is no explicit exploitation detail provided in the initial documents. Several connected advisories corroborate a Deserialization of Untrus...

CVE-2021-23338 Deserialization of Untrusted Data

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

CVE-2021-23338

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

Qlib Security Vulnerabilities

A security vulnerability exists in all versions of qlib that stems from the use of insecure YAML load functions for workflow functions...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

Deserialization of untrusted data

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

CVE-2021-27213 affects pystemon’s config.py, where YAML deserialization allows code execution because SafeLoader/safe_load are not used. Impact: potential arbitrary code execution via YAML input (high/critical). References indicate a fix was committed (dbeb87afefdb63de2f4cff69b6f10c5965d14b54); r...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

Code Injection in adobe/ops-cli

Description ops-cli is a wrapper for Terraform, Ansible, Helmfile and SSH for cloud automation , which is vulnerable to Arbitary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash pip install ops-cli Run exploit.py...

Code Injection in adobe/himl

Description himl is a hierarchical config using yaml in Python, which is vulnerable to Arbitary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash pip install himl Run exploit.py import os os.system'pip install himl...

Code Injection in unix121/i3wm-themer

Description i3wm-themer is the theme collection manager for i3-wm which is vulnerable to Arbitrary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash git clone https://github.com/unix121/i3wm-themer cd i3wm-themer/...

Code Injection in heartexlabs/label-studio

Description Label Studio is a swiss army knife of data labeling and annotation tools which is vulnerable to Arbitrary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash pip3 install label-studio Run exploit.py impor...

Arbitrary Code Execution

Overview nni is a Neural Network Intelligence package Affected versions of this package are vulnerable to Arbitrary Code Execution. Arbitrary code execution is possible due to a use of a known vulnerable function load within yaml parsing. PoC 1. Create the following PoC file: exploit.py import os...

DEBIAN-CVE-2020-14343

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be...