Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2022-1471

Remote Code execution in SnakeYAML

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

CVSS 3.1 · 8.3 High EPSS 99.5% KEV · Not listed
Vendors
Redhat Snakeyaml Project
Products
Amq Clients Amq Streams Enterprise Linux and 11 more
CVE-2022-41854

Stack Overflow in Snakeyaml

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

CVSS 3.1 · 5.8 Medium EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Redhat Snakeyaml Project
Products
Fedora Amq Clients Camel Spring Boot and 10 more
CVE-2022-38749

DoS in SnakeYAML

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Redhat Snakeyaml Project
Products
Debian Linux Amq Broker Amq Clients and 8 more