parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI i…
CVSS 3.0CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.38843·Published 2018-10-23·Fixed in 1.2.31, 1.12.0CWE-20
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.
CVSS 3.0CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.03653·Published 2018-10-11·Fixed in 1.12.0CWE-502
XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken.
THREATIST.IORead the docs