SUSE CVE-2014-2525

Heap-based buffer overflow in the yamlparserscanuriescapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file...

SUSE CVE-2019-6292

An issue was discovered in singledocparser.cpp in yaml-cpp aka LibYaml-C++ 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote...

snakeyaml: Denial of Service due to missing nested depth limitation for collections

A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service DoS due to missing nested depth limitation for collections...

snakeyaml: Denial of Service due to missing nested depth limitation for collections

A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service DoS due to missing nested depth limitation for collections...

GHSA-W37G-RHQ8-7M4J Snakeyaml vulnerable to Stack overflow leading to denial of service

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack...

Jenkins plugins Multiple Vulnerabilities (2022-09-21)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins 2.367 through 2.369 both inclusive does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins...

[SECURITY] [DLA 3132-1] snakeyaml security update

Debian LTS Advisory DLA-3132-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 03, 2022 https://wiki.debian.org/LTS Package : snakeyaml Version : 1.23-1+deb10u1 CVE ID : CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 Debian Bug : 1019218 Sever...

RCE vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by attackers able to modify .ci.yml files in SCM. This plugin has been suspended...

GHSA-X3JJ-RGW9-7R5G RCE vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by attackers able to modify .ci.yml files in SCM. This plugin has been suspended...

CVE-2022-41237

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2022-41237

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2022-41237

CVE-2022-41237 affects Jenkins DotCi Plugin 2.40.00 and earlier. The vulnerability arises because the plugin’s YAML parser does not prevent the instantiation of arbitrary types, which can lead to remote code execution. This is documented across multiple sources (NVD, Red Hat advisory, OSV, and pu...

CVE-2022-41237

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2022-41237

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Jenkins DotCi Plugin 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A code issue vulnerability...

PT-2022-25752 · Jenkins · Jenkins Dotci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins DotCi Plugin versions 2.40.00 and earlier Description: The issue arises from the Jenkins DotCi Plugin not configuring its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

GHSA-9W3M-GQGF-C4P9 snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DoS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow...

DEBIAN-CVE-2022-38751

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow...

DEBIAN-CVE-2022-38749

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow...

SnakeYAML 缓冲区错误漏洞

SnakeYAML is a Java-based YAML parser. SnakeYAML suffers from a buffer error vulnerability that stems from the fact that parsing untrusted YAML files may be susceptible to a denial of service attack DOS. If the parser is run on user-supplied input, an attacker can cause the parser to crash due to...