Design/Logic Flaw

The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...

PYSEC-2014-24

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

CVE-2011-4103

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

PYSEC-2014-25

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

Design/Logic Flaw

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

CVE-2011-4104

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

CVE-2011-4103

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

CVE-2011-4103

Removed by vendor...

CVE-2011-4103

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

CVE-2011-4104

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

CVE-2011-4104

CVE-2011-4104 affects Django Tastypie (older than 0.9.10). The vulnerability arises from the from_yaml deserialization in serializers.py, where YAML data is deserialized with yaml.load, allowing remote attackers to execute arbitrary Python code. The connected documents confirm the impact and vect...

CVE-2011-4103

The CVE concerns Django Piston: the emitter component (emitters.py) in Django Piston before 0.2.3 and in 0.2.x before 0.2.2.1 fails to properly deserialize YAML data, enabling remote code execution via yaml.load-related vectors. The vulnerability arises from YAML deserialization in the affected c...

PT-2014-2163

Name of the Vulnerable Software and Affected Versions Django Tastypie versions prior to 0.9.10 Description The issue concerns the improper deserialization of YAML data by the from yaml method in serializers.py, allowing remote attackers to execute arbitrary Python code via vectors related to the...

PT-2014-2162

Name of the Vulnerable Software and Affected Versions Django Piston versions prior to 0.2.3 Django Piston versions 0.2.x prior to 0.2.2.1 Description The issue is related to the improper deserialization of YAML data in the emitters.py file, which allows remote attackers to execute arbitrary Pytho...

PT-2014-2182

Name of the Vulnerable Software and Affected Versions cobbler versions prior to 2.2.2 Description The issue allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe load function, as demonstrated using Puppet...

APPLE-SA-2014-10-16-3 OS X Server v4.0

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-3 OS X Server v4.0 OS X Server v4.0 is now available and addresses the following: BIND Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in BIND, the most serious of which may lead to a denial of service...

Fedora 21 : php-symfony-2.5.4-1.fc21 (2014-10239)

2.5.4 2014-09-03 - security 11832 CVE-2014-6072 fabpot - security 11831 CVE-2014-5245 stof - security 11830 CVE-2014-4931 aitboudad, Jeremy Derusse - security 11829 CVE-2014-6061 damz, fabpot - security 11828 CVE-2014-5244 nicolas-grekas, larowlan - bug 10197 FrameworkBundle PhpExtractor bugfix a...

rubygem-hammer_cli_foreman: /etc/hammer/cli.modules.d/foreman.yml is world-readable

rubygem-hammercliforeman: File /etc/hammer/cli.modules.d/foreman.yml world readable...

CVE-2014-3492

Multiple cross-site scripting XSS vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter 1 name or 2 value related to the host...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter 1 name or 2 value related to the host...