Security Update for Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML...

CVE-2023-30473

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Maxim Glazunov YML for Yandex Market plugin = 3.10.7 versions...

CVE-2023-30473

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Maxim Glazunov YML for Yandex Market plugin = 3.10.7 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Maxim Glazunov YML for Yandex Market plugin = 3.10.7 versions...

CVE-2023-30473 WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Maxim Glazunov YML for Yandex Market plugin = 3.10.7 versions...

CVE-2023-30473 WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Maxim Glazunov YML for Yandex Market plugin = 3.10.7 versions...

CVE-2023-30473

CVE-2023-30473 affects WordPress plugin YML for Yandex Market (author Maxim Glazunov) up to version 3.10.7, with unauthenticated reflected XSS. Patch guidance is to upgrade to 3.10.8 or later. Public sources in connected docs confirm XSS as the vulnerability class and indicate the fix/version. No...

WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)

Software YML for Yandex Market Type Plugin Vulnerable versions = 3.10.7 Fixed in 3.10.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30473 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f6c712d90dfe Credits LEE SE...

PT-2023-10106 · Unknown · Drybjed Ansible-Ntp

Name of the Vulnerable Software and Affected Versions: drybjed ansible-ntp affected versions not specified Description: A problematic vulnerability has been found in drybjed ansible-ntp, affecting some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control...

CVE Report Published for Spring Tools

We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report: - CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode Please review the information in the CVE report and upgrade immediately. Eclipse: STS...

Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

qdPM 9.2 Information Disclosure

Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure Unauthenticated Date: 03/08/2021 Exploit Author: Leon Trappett thepcn3rd Vendor Homepage: https://qdpm.net/ Software Link: https://sourceforge.net/projects/qdpm/files/latest/download Version: 9.2 Tested on: Ubuntu 20.04 Apache2...

qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated) Vulnerability

Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure Unauthenticated Exploit Author: Leon Trappett thepcn3rd Vendor Homepage: https://qdpm.net/ Software Link: https://sourceforge.net/projects/qdpm/files/latest/download Version: 9.2 Tested on: Ubuntu 20.04 Apache2 Server running PH...

GHSA-2FMP-7XWF-WVWR Arbitrary File Read in Snyk Broker

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json...

Arbitrary File Read

snyk-broker is vulnerable to arbitrary file read. An attacker is able to access and read arbitrary files that contain the extensions .yaml, .yml or .json...

Remote Code Execution

JYaml is vulnerable to remote code execution. The library allows unsafe deserialization via the load function, allowing an attacker to execute arbitrary code on the system using a malicious .yml file...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

Remote Code Execution (RCE)

Superset is vulnerable to remote code execution RCE attacks. The application uses the unsafe yaml.load function, allowing a malicious user to inject and execute arbitrary code through a .yml file...

Drupal 8 configuration file download vulnerability analysis-vulnerability warning-the black bar safety net

Author: p0wd3r know Chong Yu 4 0 4 Security lab Date: 2016-09-22 0x00 vulnerability overview 1. Vulnerability description Drupal （ https://www.drupal.org is a free open source content management system, recent researchers have found in it 8. x 8.1.10 version found three security vulnerabilities,...