4531 matches found
CVE-2020-10721
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...
CVE-2020-10721
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...
Deserialization of untrusted data
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...
CVE-2020-10721
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...
Ubuntu: Security Advisory (USN-4595-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-4595-1 grunt vulnerability
It was discovered that Grunt did not properly load yaml files. An attacker could possibly use this to execute arbitrary code. CVE-2020-7729...
USN-4595-1: Grunt vulnerability
It was discovered that Grunt did not properly load yaml files. An attacker could possibly use this to execute arbitrary code. CVE-2020-7729...
CVE-2020-10721
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...
Arbitrary Code Execution
shiba is vulnerable to arbitrary code execution. The vulnerability exists through the use of the unsafe function load in js-yaml...
CVE-2020-7738
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...
CVE-2020-7738
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...
Code injection
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...
CVE-2020-7738 Arbitrary Code Execution
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...
CVE-2020-7738
CVE-2020-7738 affects the shiba package. The root cause is the use of js-yaml.load() instead of the secure js-yaml.safeLoad(), enabling Arbitrary Code Execution. Affected: all shiba versions; impact: arbitrary code execution; remediation: Snyk notes no fixed shiba version yet. References include ...
PT-2020-15704 · Cloudflare · Cloudflared
Name of the Vulnerable Software and Affected Versions: cloudflared versions prior to 2020.8.1 Description: The issue allows for local privilege escalation on Windows systems due to the way cloudflared searches for and reads configuration files. This could be exploited by a malicious entity to...
Fedora: Security Advisory for pandoc-citeproc (FEDORA-2020-c39d7a562c)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
The vulnerability of the jw.util package, related to errors in checking the processed YAML files during configuration loading, allows a attacker to execute arbitrary operating system commands.
The vulnerability of the jw.util package is related to errors during the validation of YAML files processed when loading configuration files. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the operating system...
The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
...
An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap HandleMap HandleFlowSequence HandleSequence HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file.
...