Home
Trends
Vulnerabilities
News
Researchers
Why dbugs?

Daveyss

#27038of 53,624
9.3Total CVSS
Vulnerabilities · 1
PT-2014-2163
9.3
2014-10-27
Django · Django Tastypie · CVE-2011-4104
**Name of the Vulnerable Software and Affected Versions** Django Tastypie versions prior to 0.9.10 **Description** The issue concerns the improper deserialization of YAML data by the `from yaml` method in `serializers.py`, allowing remote attackers to execute arbitrary Python code via vectors related to the `yaml.load` method. **Recommendations** For versions prior to 0.9.10, update to version 0.9.10 or later to resolve the issue. As a temporary workaround, consider disabling the `from yaml` method until a patch is available. Restrict access to the `yaml.load` method to minimize the risk of exploitation.