Início
Tendências
Vulnerabilidades
Notícias
Pesquisadores
Por que dbugs?

Daveyss

#27302de 53,632
9.3CVSS total
Vulnerabilidades · 1
PT-2014-2163
9.3
2014-10-27
Django · Django Tastypie · CVE-2011-4104
**Name of the Vulnerable Software and Affected Versions** Django Tastypie versions prior to 0.9.10 **Description** The issue concerns the improper deserialization of YAML data by the `from yaml` method in `serializers.py`, allowing remote attackers to execute arbitrary Python code via vectors related to the `yaml.load` method. **Recommendations** For versions prior to 0.9.10, update to version 0.9.10 or later to resolve the issue. As a temporary workaround, consider disabling the `from yaml` method until a patch is available. Restrict access to the `yaml.load` method to minimize the risk of exploitation.