rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code...

rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code...

Updated yaml-cpp packages fix security vulnerability

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.1 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file. CVE-2017-5950...

MGASA-2018-0471 Updated yaml-cpp packages fix security vulnerability

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.1 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file. CVE-2017-5950...

Tablib: Arbitrary command execution

Background Tablib is an MIT Licensed format-agnostic tabular dataset library, written in Python. It allows you to import, export, and manipulate tabular data sets. Description A vulnerability was discovered in Tablib’s Databook loading functionality, due to improper input validation. Impact A...

GLSA-201811-18 : Tablib: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-201811-18 Tablib: Arbitrary command execution A vulnerability was discovered in Tablibs Databook loading functionality, due to improper input validation. Impact : A remote attacker, by enticing the user to process a specially...

Open Source IPS: Suricata

Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection IDS, inline intrusion prevention IPS, network security monitoring NSM and offline pcap processing. Suricata inspects the network traffic usi...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

Design/Logic Flaw

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy, CVE-2018-18850 affects versions 2018.8.0 through 2018.9.x before 2018.9.1. An authenticated user with permission to modify deployment processes could upload a malicious YAML configuration, potentially allowing remote code execution within the Octopus Server process (often SYSTE...

CVE-2018-18850: Undefined Security Weakness

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

PT-2018-14689

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2018.8.0 through 2018.9.0 Description The issue allows an authenticated user with permission to modify deployment processes to upload a maliciously crafted YAML configuration. This could potentially allow for remote...

Ubuntu: Security Advisory (USN-3553-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3685-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-Q7PF-QR96-2VQ5 Deserialization of Untrusted Data in swagger-parser

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

Deserialization of Untrusted Data in swagger-parser

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

Deserialization of Untrusted Data in swagger-codegen

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

GHSA-VGVF-9JH3-FG75 Deserialization of Untrusted Data in swagger-codegen

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize will deserialize user-controlled types in the line "currentType = Type.GetTypenodeEvent.Tag.Substring1, throwOnError: false;" and blindly instantiates...

GHSA-RPCH-CQJ9-H65R High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize will deserialize user-controlled types in the line "currentType = Type.GetTypenodeEvent.Tag.Substring1, throwOnError: false;" and blindly instantiates...