Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2016-4972

openstack-murano: RCE via usage of insecure YAML tags

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Openstack
Products
Mitaka-murano Murano Murano-dashboard and 1 more
CVE-2024-29156

YAQL: OpenStack Murano Component Information Leakage

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Murano Yaql Openstack