Vulnerabilities

Filters

2 selected

37 records

Sort

Vendor: XStream Component: Xstream Clear all filters

TI-2022-20306 CVE-2022-41966 · GHSA-j563-grx4-pjpv

XStream Denial of Service via stack overflow

HIGH 75

XStream serializes Java objects to XML and back again.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.09347 Published 2022-12-27 Partial fix · 1.4.20 CWE-120

TI-2022-19041 CVE-2022-40152 · GHSA-3f7h-mf4q-vrm4

Stack Buffer Overflow in Woodstox

HIGH 66

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18215 Published 2022-09-16 Partial fix · 6.4.0, 5.4.0 CWE-121

TI-2022-19040 CVE-2022-40151 · GHSA-f8cc-g7j8-xxpm

Stack Buffer Overflow in xstream

HIGH 66

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02222 Published 2022-09-16 Partial fix · 1.4.20 CWE-121

TI-2021-19665 CVE-2021-43859 · GHSA-rmr5-cpv2-vgjf

Denial of Service by injecting highly recursive collections or maps in XStream

HIGH 72

XStream is an open source java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07934 Published 2022-02-01 Partial fix · 1.4.19 CWE-400

TI-2021-16536 CVE-2021-39150 · GHSA-cxfm-5m4g-x7xp

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

MEDIUM 51

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.03437 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-16538 CVE-2021-39152 · GHSA-xw4p-crpj-vjx2

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

MEDIUM 56

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.11377 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-16527 CVE-2021-39140 · GHSA-6wf9-jmg9-vxcc

XStream can cause a Denial of Service

MEDIUM 44

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.05918 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-16535 CVE-2021-39149 · GHSA-3ccq-5vw3-2p6x

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16534 CVE-2021-39148 · GHSA-qrx8-8545-4wg2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16533 CVE-2021-39147 · GHSA-h7v4-7xg3-hxcc

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16532 CVE-2021-39146 · GHSA-p8pq-r894-fm8f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 60

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.143 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16531 CVE-2021-39145 · GHSA-8jrj-525p-826v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04065 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16528 CVE-2021-39141 · GHSA-g5w6-mrj7-75h2

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 61

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.16118 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16539 CVE-2021-39153 · GHSA-2q8x-2p7f-574v

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04457 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16537 CVE-2021-39151 · GHSA-hph2-m3g5-xxv4

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16526 CVE-2021-39139 · GHSA-64xx-cq4q-mf44

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 53

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0454 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16540 CVE-2021-39154 · GHSA-6w62-hx7r-mw68

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 52

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.04735 Published 2021-08-23 Partial fix · 1.4.18 CWE-434

TI-2021-16530 CVE-2021-39144 · GHSA-j9h8-phrw-h4fh

XStream is vulnerable to a Remote Command Execution attack

CRITICAL 96KEV

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.98124 Published 2021-08-23 Partial fix · 1.4.18 CWE-502

TI-2021-10213 CVE-2021-29505 · GHSA-7chv-rrw6-w6fc

XStream is vulnerable to a Remote Command Execution attack

HIGH 79

XStream is software for serializing Java objects to XML and back again.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77232 Published 2021-05-28 Partial fix · 1.4.17 CWE-502

TI-2021-04448 CVE-2021-21348 · GHSA-56p8-3fh9-4cvq

XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

MEDIUM 54

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13832 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04450 CVE-2021-21350 · GHSA-43gc-mjxg-gvrq

XStream is vulnerable to an Arbitrary Code Execution attack

HIGH 65

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15234 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04451 CVE-2021-21351 · GHSA-hrcp-8f3q-4w2c

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.82136 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502