Read the docs

Exadel

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Exadel records in CISA KEV

No Exadel vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Flamingo 2 records MEDIUM Flamingo Amf-serializer 1 record MEDIUM

Records

3 records

TI-2017-02407 CVE-2017-3202 · GHSA-j88v-q3vw-p9vr

Deserialization of untrusted data in Exadel Flamingo amf-serializer

Priority MEDIUM 53

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbit…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08071 Published 2018-06-11 No fix listed CWE-913
TI-2017-02410 CVE-2017-3206 · GHSA-685x-q7j3-8c52

XML external entity injection in Exadel Flamingo amf-serializer

Priority MEDIUM 48

The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03617 Published 2018-06-11 No fix listed CWE-611
TI-2017-02406 CVE-2017-3201 · GHSA-952v-mg9c-m7vp

Deserialization of untrusted data in Exadel Flamingo amf-serializer

Priority MEDIUM 43

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.util…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.05173 Published 2018-06-11 No fix listed CWE-502
Open these records in search →