yaml project yaml vulnerabilities and exploits

(subscribe to this query)

6.8

CVSSv2

The JS-YAML module prior to 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote malicious users to execute arbitrary code via a crafted string that triggers an eval operation.

1 EDB exploit1 Github repository

NA

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

Yaml Project Yaml

NA

Uncaught Exception in GitHub repository eemeli/yaml before 2.0.0-5.

Yaml Project Yaml

NA

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

Yaml Project Yaml

5

CVSSv2

An issue exists in the yaml-rust crate prior to 0.4.1 for Rust. There is uncontrolled recursion during deserialization.

Yaml-rust Project Yaml-rust

4.3

CVSSv2

yaml-rust 0.4.0 and previous versions is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4...

Yaml-rust Project Yaml-rust

4.3

CVSSv2

serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed version is: 0.8.4 and later.

Serde-yaml Project Serde-yaml

5

CVSSv2

The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and previous versions allows remote malicious users to cause a denial of service (assertion failure and application exit) via a '!2' string.

Yaml-cpp Project Yaml-cpp

4.3

CVSSv2

The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote malicious users to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

Yaml-cpp Project Yaml-cpp 0.6.2

4.3

CVSSv2

The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote malicious users to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

Yaml-cpp Project Yaml-cpp 0.6.2

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook