ExploitTensorflowCVE-2021-37678

CVE-2021-37678 익스플로잇 취약점을 악용하려면 Docker 컨테이너를 띄워야 하며, 해당 컨테이너에는 취약점이 여전히 존재하는 버전 2.2.3의 Tensorflow를 실행할 준비된 환경이 마련되어 있어야 합니다. 구성 요소: 64비트 AMD 아키텍처 AVX 명령어를 실행할 수 있는 CPU 또는 GPU 64비트 Python 3.6.9 Pip3 20.2.4 Tensorflow 2.2.3 PyYAML 3.12 다음 명령어를 실행하여 시스템에 Docker가 설치되어 있는지 확인하세요: docker -v 운영체제에 Docke...

loader-CVE-2020-14343

loader-CVE-2020-14343 PyYAML 패키지에서 CVE-2020-14343의 안전하지 않은 역직렬화를 통해 명령 실행이 가능한 웹 애플리케이션입니다. 해설: https://github.com/TebbaaX/CTFs/blob/main/HackerNewsBdarija-CTF-2022/loadder/Loader.md...

cve-2020-14343-lab

CVE-2020-14343 – PyYAML Unsafe YAML Loading Lab 1. Project Overview This project demonstrates CVE-2020-14343 in a controlled and isolated Docker environment. The lab contains two environments: A vulnerable environment using PyYAML 5.3.1 A patched environment using PyYAML 5.4 and yaml.safeload The...

CVE-2025-50460

CVE-2025-50460: modelscope/ms-swift의 안전하지 않은 PyYAML 역직렬화를 통한 원격 코드 실행 상태: 분석 대기 중 이 CVE 기록은 NVD 보강 작업을 위해 표시되었습니다. ms-swift 프로젝트 버전 3.3.0에서 PyYAML 라이브러리버전 = 5.3.1의 yaml.load를 사용하는 tests/run.py의 안전하지 않은 역직렬화로 인해 원격 코드 실행RCE 취약점이 존재합니다. 공격자가 --runconfig 매개변수에 전달된 YAML 설정 파일의 내용을 제어할 수 있는 경우 역직렬화 중에...

CVE-2020-14343-PyYAML

CVE-2020-14343 PyYAML 역직렬화 취약점 POC 취약점 개요 항목| 정보 ---|--- CVE 번호| CVE-2020-14343 영향 컴포넌트| PyYAML 예시: python poc.py http://vulnerable-site.com 192.168.1.100 4444 공격 흐름 1. 스크립트가 로컬에서 TCP 리스너를 시작합니다 2. 악성 YAML 파일을 대상의 /upload 엔드포인트에 업로드합니다 3. /login 엔드포인트를 트리거하여 YAML을 로드하고 파싱합니다 4. 대상 서버가 payload를 실행...

CVE-2026-10036-speechbrain-rce

CVE-2026-10036: SpeechBrain의 CKPT.yaml 파싱을 통한 임의 코드 실행 심각도: 높음, CVSS 4.0 8.7 , CVSS 3.1 8.8 CNA인 VulnCheck가 지정 벡터 v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 벡터 v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 영향 대상: SpeechBrain listcheckpoints -...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2026:4402-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4402-1 advisory. - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code...

docling-core-CVE-2026-24009

CVE-2026-24009 — docling-core 안전하지 않은 YAML 역직렬화 PoC + 참고 사항 이 저장소는 CVE-2026-24009 를 입증하는 개념 증명PoC과 간단한 스캐너를 포함합니다. 이 취약점은 특정 종속성 조건에서 docling-core가 공격자가 제어하는 YAML을 로드할 때 코드 실행을 가능하게 합니다. TL;DR 영향: YAML 파싱 중 잠재적 RCE 취약한 체인모두 필요: docling-core = 2.21.0 및 = 2.48.4로 업그레이드 yaml.SafeLoader로 전환 대체 수정:...

Rocky Linux 8.6 [CIQ] Security Update: python39-pyyaml / python39-pyyaml-debuginfo (ciqsa-2026_0239)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260239 advisory. This advisory aggregates security fixes for the PyYAML SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2021-28861. Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2020_4641)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204641 advisory. PyYAML: command execution through python/object/apply constructor in FullLoader CVE-2019-20477 python: infinite loop in the tarfile module via crafted TAR...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc (crlsa-2021_2583)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212583 advisory. PyYAML: incomplete fix for CVE-2020-1747 CVE-2020-14343 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8.6 [CIQ] Security Update: python38-pyyaml / python38-pyyaml-debuginfo Multiple Vulnerabilities (ciqsa-2026_0218)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260218 advisory. This advisory aggregates security fixes for the PyYAML SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...

Rocky Linux 8.6 [CIQ] Security Update: python2-pyyaml / python2-pyyaml-debuginfo Multiple Vulnerabilities (ciqsa-2026_0186)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260186 advisory. This advisory aggregates security fixes for the PyYAML SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2023-32681, CVE-2022-45061,...

Rocky Linux 8.6 [CIQ] Security Update: python39-pyyaml / python39-pyyaml-debuginfo Multiple Vulnerabilities (ciqsa-2026_0765)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260765 advisory. This advisory aggregates security fixes for the PyYAML SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...

Security update for python-PyYAML

This update for python-PyYAML fixes the following issues: Update to 5.3.1. CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader...

SUSE-SU-2026:4402-1 Security update for python-PyYAML

This update for python-PyYAML fixes the following issues: - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loade...

Exploit for Improper Input Validation in Pyyaml

CVE-2020-14343 – PyYAML Unsafe YAML Loading Lab 1. Project...

Astra Linux – Vulnerability in pyyaml

A vulnerability was discovered in the PyYAML library in versions prior to 5.4. In these versions, the library is susceptible to arbitrary code execution when it processes untrusted YAML files using the fullload method or the FullLoader loader. Applications that use this library to process untrust...

SUSE CVE-2026-84202

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202

A flaw was found in ModelScope. This vulnerability arises from the use of PyYAML's unsafe yaml.Loader when parsing model configuration files. A remote attacker can exploit this by crafting malicious model repositories containing poisoned configuration files. When these files are loaded by a user,...