Vulnerabilities

TI-2021-04448 CVE-2021-21348 · GHSA-56p8-3fh9-4cvq

XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

MEDIUM 54

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13832 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04450 CVE-2021-21350 · GHSA-43gc-mjxg-gvrq

XStream is vulnerable to an Arbitrary Code Execution attack

HIGH 65

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15234 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04451 CVE-2021-21351 · GHSA-hrcp-8f3q-4w2c

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.82136 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04444 CVE-2021-21344 · GHSA-59jw-jqf4-3wq3

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7598 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04445 CVE-2021-21345 · GHSA-hwpc-8xqv-jvj4

XStream is vulnerable to a Remote Command Execution attack

HIGH 81

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.72324 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04446 CVE-2021-21346 · GHSA-4hrm-m67v-5cxr

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.76367 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04447 CVE-2021-21347 · GHSA-qpfq-ph7r-qv6f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 64

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14301 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2019-00164 CVE-2019-0187 · GHSA-wg37-7mrv-cfwm

Broken or risky cryptographic algorithm in Apache JMeter

MEDIUM 47

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02636 Published 2019-03-06 Fixed in 5.1 CWE-327

TI-2018-01192 CVE-2018-1287 · GHSA-j7j7-g4ww-pxg5

Improper signature verification in Apache JMeter

MEDIUM 48

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03352 Published 2018-02-14 Fixed in 4.0 CWE-347

TI-2018-01201 CVE-2018-1297 · GHSA-7v85-6hv2-rwgw

Cleartext transmission of sensitive information in Apache JMeter

MEDIUM 55

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11502 Published 2018-02-13 Fixed in 4.0 CWE-319

Vulnerabilities

Filters