python: Unsafe use of eval() on data retrieved via HTTP in the test suite

In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...

PYSEC-2021-119

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

UBUNTU-CVE-2014-4678

The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...

ansible: unsafe template evaluation of returned module data can lead to information disclosure

A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed...

Command Execution Vulnerability in ESPCMS

ESPCMS is an enterprise building management system based on PHP+MYSQL. A command execution vulnerability exists in ESPCMS. The vulnerability stems from the program's failure to escape and filter strings when calling the eval function to process strings obtained from parameters, which can be...