The HTTP client in MashZone NextGen up to and including 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code.
softwareag mashzone nextgen