xstream project xstream vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON....

Xstream Project Xstream Xstream Project Xstream 1.4.101 EDB exploit available11 Github repositories available

7.5

CVSSv3

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>")...

Xstream Project Xstream Debian Debian Linux 8.0 Debian Debian Linux 9.08 Github repositories available

7.5

CVSSv3

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML...

Debian Debian Linux 8.0 Fedoraproject Fedora 22 Fedoraproject Fedora 23 Xstream Project Xstream1 Github repository available

6.8

CVSSv3

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as...

Xstream Project Xstream Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 3512 Github repositories available

7.7

CVSSv3

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are...

Xstream Project Xstream Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 358 Github repositories available

9.1

CVSSv3

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new...

Xstream Project Xstream Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 35 Oracle Banking Virtual Account Management 14.2.0 Oracle Banking Virtual Account Management 14.3.0 Oracle Banking Virtual Account Management 14.5.0 Oracle Communications Policy Management 12.5.0 Oracle Mysql Server1 Github repository available

9.8

CVSSv3

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported...

Xstream Project Xstream 1.4.10 Oracle Banking Platform Oracle Business Activity Monitoring 11.1.1.9.0 Oracle Business Activity Monitoring 12.2.1.3.0 Oracle Communications Billing And Revenue Management Elastic Charging Engine 11.3.0.9.0 Oracle Communications Billing And Revenue Management Elastic Charging Engine 12.0.0.3.0 Oracle Communications Diameter Signaling Router Oracle Communications Unified Inventory Management 7.3.0 Oracle Communications Unified Inventory Management 7.4.0 Oracle Endeca Information Discovery Studio 3.2.0 Oracle Retail Xstore Point Of Service 17.0 Oracle Utilities Framework 2.2.0.0.0 Oracle Utilities Framework 4.2.0.2.0 Oracle Utilities Framework 4.2.0.3.0 Oracle Utilities Framework Oracle Utilities Framework 4.4.0.0.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Webcenter Portal 12.2.1.3.013 Github repositories available

7.5

CVSSv3

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service...

Xstream Project Xstream Fedoraproject Fedora 34 Fedoraproject Fedora 35 Debian Debian Linux 9.0 Oracle Flexcube Private Banking 12.1.0 Oracle Commerce Guided Search 11.3.2 Oracle Retail Xstore Point Of Service 16.0.6 Oracle Retail Xstore Point Of Service 17.0.4 Oracle Retail Xstore Point Of Service 18.0.3 Oracle Retail Xstore Point Of Service 19.0.2 Oracle Retail Xstore Point Of Service 20.0.1 Oracle Communications Cloud Native Core Automated Test Suite 1.9.0 Oracle Communications Policy Management 12.6.0.0.0 Oracle Communications Diameter Intelligence Hub Oracle Communications Brm - Elastic Charging Engine 12.0.0.5.0 Oracle Communications Brm - Elastic Charging Engine

8.5

CVSSv3

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed...

Xstream Project Xstream Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 35 Netapp Snapmanager -Oracle Utilities Framework 4.2.0.3.0 Oracle Utilities Framework 4.2.0.2.0 Oracle Utilities Framework 4.3.0.6.0 Oracle Utilities Framework 4.4.0.0.0 Oracle Communications Unified Inventory Management 7.3.4 Oracle Communications Unified Inventory Management 7.3.5 Oracle Communications Unified Inventory Management 7.4.0 Oracle Utilities Framework 4.4.0.2.0 Oracle Communications Billing And Revenue Management Elastic Charging Engine 11.3 Oracle Communications Billing And Revenue Management Elastic Charging Engine 12.0 Oracle Business Activity Monitoring 12.2.1.4.0 Oracle Communications Unified Inventory Management 7.4.1 Oracle Utilities Framework 4.4.0.3.0 Oracle Utilities Testing Accelerator 6.0.0.1.1 Oracle Communications Cloud Native Core Binding Support Function 1.10.0 Oracle Utilities Framework 4.3.0.1.0 Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Communications Unified Inventory Management 7.4.22 Github repositories available

8.5

CVSSv3

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed...

Xstream Project Xstream Fedoraproject Fedora 33 Fedoraproject Fedora 34 Fedoraproject Fedora 35 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Netapp Snapmanager -Oracle Utilities Framework 4.2.0.3.0 Oracle Utilities Framework 4.2.0.2.0 Oracle Utilities Framework 4.3.0.6.0 Oracle Utilities Framework 4.4.0.0.0 Oracle Communications Unified Inventory Management 7.3.4 Oracle Communications Unified Inventory Management 7.3.5 Oracle Communications Unified Inventory Management 7.4.0 Oracle Utilities Framework 4.4.0.2.0 Oracle Communications Billing And Revenue Management Elastic Charging Engine 11.3 Oracle Communications Billing And Revenue Management Elastic Charging Engine 12.0 Oracle Business Activity Monitoring 12.2.1.4.0 Oracle Communications Unified Inventory Management 7.4.1 Oracle Utilities Framework 4.4.0.3.0 Oracle Utilities Testing Accelerator 6.0.0.1.1 Oracle Communications Cloud Native Core Binding Support Function 1.10.0 Oracle Utilities Framework 4.3.0.1.0 Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Communications Unified Inventory Management 7.4.21 Github repository available

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook