Deserialization of untrusted data

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342...

CVE-2019-20477

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342...

CVE-2019-20478

In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safeload in these use cases...

CVE-2019-20478

In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safeload in these use cases...

PT-2020-10463 · Ruamel +2 · Ruamel.Yaml +2

Name of the Vulnerable Software and Affected Versions: ruamel.yaml versions prior to 0.16.8 Description: The issue allows remote code execution when the load method is called with an untrusted argument, affecting developers who do not use safe methods like safe load. Recommendations: For versions...

Iteris Vantage Velocity Field Unit Cross-Site Scripting Vulnerability

The Iteris Vantage Velocity Field Unit is a road monitoring field unit from Iteris USA. A cross-site scripting vulnerability exists in all parameters of the Start Data Viewer function of the /cgi-bin/loaddata.py script in the Iteris Vantage Velocity Field Unit version 2.4.2. The vulnerability ste...

Microsoft Windows Secure Boot Security Feature Bypass Vulnerability (CNVD-2020-16651)

Microsoft Windows is a popular operating system. A security feature bypass vulnerability exists in Microsoft Windows Secure Boot, which allows remote attackers to exploit the vulnerability to submit a special application request that can bypass Secure Boot and load untrusted software...

5iSNS content payment system has XSS vulnerability

5iSNS content payment system is a home-grown , small , stable , support in large amounts of data still maintain a high load capacity of the SNS open source system , the system supports unlimited module expansion , plug-in expansion . 5iSNS content payment system XSS vulnerability , attackers can...

Important: Red Hat Bug Fix Advisory: Satellite 6.6.2 Async Bug Fix Update

Updated Satellite 6.6 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clien...

Product update: Virtuozzo 7.0 Update 12 Hotfix 3 (7.0.12-361)

The Hotfix 3 for Virtuozzo 7.0 Update 12 provides stability and usability bug fixes. Vulnerability id: PSBM-100126 Ploop is corrupted after node reboot repair image outgrows device size. Vulnerability id: PSBM-101150 vzstat does not show actual IO and IOPS load and limits. Vulnerability id:...

Foxit PDF Compression Master DLL Hijacking Vulnerability

Foxit PDF Compression Master is a document compression software. Foxit PDF Compressor has a DLL hijacking vulnerability. An attacker can exploit this vulnerability to load a fake malicious dll file...

F5 Networks BIG-IP : BIND vulnerability (K15840535)

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to...

CVE-2014-5288

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages...

Cross site request forgery (csrf)

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages...

CVE-2014-5288

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages...

CVE-2014-5288

Kemp Load Master is affected by a CSRF vulnerability (CVE-2014-5288) in the web administrative interface prior to version 7.0-18a. Public writeups and exploit listings (e.g., 7.1.16 era) describe additional issues (RCE, XSS, DoS) in Kemp Load Master, indicating multiple vulnerabilities around the...

PT-2020-11542 · Google +4 · Android +4

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 Description: The issue is related to an integer overflow in the exif data load data thumbnail function of exif-data.c, which could lead to a remote denial of service. No additional execution privileges are needed f...

CVE-2019-12180

An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code Java scripting language on the victim machine by inducing it ...

Denial Of Service (DoS)

github.com/hashicorp/consul is vulnerable to denial of service DoS. The attack exists due to a lack of controlling unbounded resource usage via unauthenticated HTTP or RPC connections, allowing an attacker to trigger excessive load and crash the server...

SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c

A heap-based buffer overflow was discovered in SDL in the SDLBlitCopy function, that was called while copying an existing surface into a new optimized one, due to lack of validation while loading a BMP image in the SDLLoadBMPRW function. An application that uses SDL to parse untrusted input files...