Read the docs

XStream

Records38All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high27CVSS 7.0–8.9

Exploited now

XStream records in CISA KEV
TI-2021-16530 XStream Remote Code Execution Vulnerability Priority CRITICAL 96KEV 2023-03-10

Components

Products in the NVD configurations · select one to filter the records
Xstream 37 records CRITICAL

Records

37 records in Xstream · all components

TI-2013-05951 CVE-2013-7285 · GHSA-f554-x222-wgf7

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not…

Priority CRITICAL 90

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarsh…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84362 Published 2019-05-15 Partial fix · 1.4.7, 1.4.11 CWE-78
TI-2020-16038 CVE-2020-26217 · GHSA-mw36-7c6c-q4q2

Remote Code Execution in XStream

Priority CRITICAL 87

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.84968 Published 2020-11-16 Partial fix · 1.4.14, 1.4.14-java7 CWE-78
TI-2019-07494 CVE-2019-10173 · GHSA-hf23-9pf7-388p

Code injection in xstream

Priority CRITICAL 86

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95036 Published 2019-07-23 Fixed in 1.4.11 CWE-94
TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

Priority HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400
TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

Priority HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2022-20306 CVE-2022-41966 · GHSA-j563-grx4-pjpv

XStream Denial of Service via stack overflow

Priority HIGH 75

XStream serializes Java objects to XML and back again.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.09347 Published 2022-12-27 Partial fix · 1.4.20 CWE-120
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

Priority HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2022-19041 CVE-2022-40152 · GHSA-3f7h-mf4q-vrm4

Stack Buffer Overflow in Woodstox

Priority HIGH 66

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18215 Published 2022-09-16 Partial fix · 6.4.0, 5.4.0 CWE-121
TI-2022-19040 CVE-2022-40151 · GHSA-f8cc-g7j8-xxpm

Stack Buffer Overflow in xstream

Priority HIGH 66

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02222 Published 2022-09-16 Partial fix · 1.4.20 CWE-121
Load more
Open these records in search →