Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Exadel Clear all filters
TI-2017-02410 CVE-2017-3206 · GHSA-685x-q7j3-8c52

XML external entity injection in Exadel Flamingo amf-serializer

Priority MEDIUM 48

The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03617 Published 2018-06-11 No fix listed CWE-611
TI-2017-02407 CVE-2017-3202 · GHSA-j88v-q3vw-p9vr

Deserialization of untrusted data in Exadel Flamingo amf-serializer

Priority MEDIUM 53

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbit…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08071 Published 2018-06-11 No fix listed CWE-913
TI-2017-02406 CVE-2017-3201 · GHSA-952v-mg9c-m7vp

Deserialization of untrusted data in Exadel Flamingo amf-serializer

Priority MEDIUM 43

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.util…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.05173 Published 2018-06-11 No fix listed CWE-502