CVE-2020-2121

The CVE-2020-2121 issue affects Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier. The root cause is the plugin’s YAML parser configuration that permits instantiation of arbitrary types, enabling remote code execution. The vulnerability is exploitable by users who can supply YAML...

PT-2020-15330 · Jenkins · Jenkins Radargun Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RadarGun Plugin versions 1.7 and earlier Description: The issue is related to the configuration of the YAML parser in the Jenkins RadarGun Plugin, which does not prevent the instantiation of arbitrary types. This results in a remote...

PT-2020-15328 · Jenkins · Jenkins Google Kubernetes Engine Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier Description: The issue is related to the configuration of the YAML parser in the Jenkins Google Kubernetes Engine Plugin, which does not prevent the instantiation of arbitrary...

SnakeYAML Denial of Service Vulnerability

SnakeYAML is a Java-based YAML parser . A security vulnerability exists in the Alias feature in SnakeYAML version 1.18. An attacker can exploit this vulnerability to cause a denial of service...

Fedora Update for PyYAML FEDORA-2019-bed9afe622

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: PyYAML-5.1-1.fc30

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...

yaml-cpp denial of service vulnerability (CNVD-2019-03332)

yaml-cpp aka LibYaml-C++ is a C++ parser for use in YAML. A denial of service vulnerability exists in the 'Scanner::EnsureTokensInQueue' function in yaml-cpp version 0.6.2. A remote attacker can exploit this vulnerability to cause a denial of service stack consumption and application crash with t...

[SECURITY] Fedora 28 Update: yaml-cpp-0.6.1-4.fc28

yaml-cpp is a YAML parser and emitter in C++ written around the YAML 1.2 sp ec...

[SECURITY] Fedora 29 Update: yaml-cpp-0.6.1-4.fc29

yaml-cpp is a YAML parser and emitter in C++ written around the YAML 1.2 sp ec...

[SECURITY] Fedora 27 Update: yaml-cpp-0.6.1-4.fc27

yaml-cpp is a YAML parser and emitter in C++ written around the YAML 1.2 sp ec...

Code injection

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...

CVE-2017-6920

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...

CVE-2017-6920

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...

CVE-2017-6920

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...

CVE-2017-6920

CVE-2017-6920 affects Drupal core 8.x before 8.3.4. Root cause: the PECL YAML parser does not safely handle PHP objects during certain operations, enabling remote code execution by an unauthenticated attacker. The provided documents do not specify exploitation vectors beyond this description, nor...

Remote Code Execution (RCE)

confire is vulnerable to remote code execution attacks. The attacks can happen because the config.py file allows users to parse their configuration from the /.confire.yaml through the yaml.load function of the YAML parser, allowing attackers to inject and execute arbitrary python commands...

Arbitrary Code Execution

owlmixin is vulnerable to arbitrary code execution attacks. It does not use the safeload method to parse YAML in the parseyamlquery method of parser.py, allowing the attacker to load any malicious Python code to the YAML parser...

Arbitrary Code Execution

pyanyapi is vulnerable to arbitrary code execution attacks. It does not use the safeload method to parse YAML in the parseyamlquery method of parser.py, allowing the attacker to load any malicious Python code to the YAML parser...

Arbitrary Code Execution

mlalchemy is vulnerable to arbitrary code execution attacks. It does not use the safeload method to parse YAML in the parseyamlquery method of parser.py, allowing the attacker to load any malicious Python code to the YAML parser...

RubyGems: Remote code execution on rubygems.org

When parsing a gem POSTed to the /api/v1/gems endpoint, the rubygems.org application immediately calls Gem::Package.newbody.spec inside app/models/pusher.rb. The authors of the application correctly observed that parsing untrusted YAML is dangerous since it can serialize more or less arbitrary...