CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly...

UBUNTU-CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly...

CVE-2020-26258 Server-Side Forgery Request can be activated unmarshalling with XStream

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly...

CVE-2020-26258

CVE-2020-26258 is a Server-Side Forgery/SSRF via XStream unmarshalling in versions prior to 1.4.15. Public docs corroborate exploitation possible by crafted input streams to access internal resources, with Java 15+ mitigating the issue and a whitelist-based Security Framework recommended over the...

CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly...

CVE-2020-26259 XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executin...

CVE-2020-26259

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executin...

CVE-2020-26259

CVE-2020-26259 affects XStream in IBM Storage Copy Data Management (2.2.0.0–2.2.25.0). Unmarshalling user-supplied data could allow arbitrary file deletion on the host if the process runs with sufficient privileges. IBM’s remediation for the affected products is to upgrade to 2.2.26.0 (Linux) and...

JFrog < 7.10.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.10.1. It is, therefore, affected by multiple vulnerabilities: - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may...

Xstream Arbitrary File Deletion Vulnerability

XStream is a lightweight , easy to use open source Java class library of the XStream team , it is mainly used to serialize objects into XML JSON or deserialize objects . An arbitrary file deletion vulnerability exists in XStream. The vulnerability stems from an exception handling during...

XStream Code Issue Vulnerability

XStream is a lightweight, easy-to-use, open source Java class library from the XStream team that is primarily used to serialize or deserialize objects into XML JSON. XStream suffers from a code issue vulnerability that stems from a server-side forged request vulnerability can be activated during...

PT-2020-6135 · Thoughtworks +3 · Xstream +3

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.15 Description: The issue allows a remote attacker to delete arbitrary files on the host as long as the executing process has sufficient rights, by manipulating the processed input stream. This can be done when...

PT-2020-6136 · Thornton Rose +3 · Xstream +3

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.15 Description: The issue is related to a Server-Side Forgery Request vulnerability in XStream, a Java library used to serialize objects to XML and back again. This vulnerability can be activated when unmarshalli...

XStream SSRF Vulnerability

XStream is a Java class library , used to serialize objects into XML or deserialize objects , XStream is free software can be distributed in the BSD license learning . XStream SSRF vulnerability, an attacker can exploit this vulnerability by specifying the demand request url in xml can be SSRF...

XStream 操作系统命令注入漏洞

XStream is a lightweight , easy to use open source Java class library of the XStream team , it is mainly used to serialize objects into XML JSON or deserialize objects . An arbitrary file deletion vulnerability exists in XStream. The vulnerability stems from an exception handling during...

Exploit for OS Command Injection in Apache Struts

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable...

The vulnerability of the Xstream Java library for converting objects to XML or JSON format arises from the lack of measures taken to eliminate special elements used in operating system commands. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of the Java library for converting objects to XML or JSON format, Xstream, exists due to the lack of measures taken to eliminate special elements used in the operating system command. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Exploit for OS Command Injection in Xstream

CVE-2020-26217-XStream-RCE-POC e.g java package org.exam...

Security Bulletin: CVE-2020-26217 XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

Summary CVE-2020-26217 XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Vulnerability Details CVEID: CVE-2020-26217 DESCRIPTION: XStream could allow a...

[SECURITY] [DLA 2471-1] libxstream-java security update

Debian LTS Advisory DLA-2471-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 30, 2020 https://wiki.debian.org/LTS Package : libxstream-java Version : 1.4.9-2+deb9u1 CVE ID : CVE-2020-26217 It was found that XStream is vulnerable to Remote Code Execution...