AZL-44379 CVE-2020-7729 affecting package js-jquery 3.5.0-4

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

serde-yaml denial of service vulnerability

serde-yaml is a Rust library that supports the use of both the Serde serialization framework and data in YAML format. A security vulnerability exists in serde serdeyaml versions 0.6.0 through 0.8.3. An attacker can exploit this vulnerability to cause a denial of service...

Resteasy: Yaml unmarshalling vulnerable to RCE

It was discovered that under certain conditions RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of potentially untrusted data. An attacker could possibly use this flaw execute arbitrary code with the permissions of the application using RESTEasy...

JSON Swagger CodeGen Parameter Injector

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Gems require 'base64' Project require 'msf/core' class MetasploitModule 'JSON Swagger CodeGen Parameter Injector', 'Description' = %q This module generates a Open API...

JSON Swagger CodeGen Parameter Injector

This module generates an Open API Specification 2.0 Swagger compliant json document that includes payload insertion points in parameters. In order for the payload to be executed, an attacker must convince someone to generate code from a specially modified swagger.json file within a vulnerable...