GHSA-38CR-2PH5-FRR9 Apache Struts REST Plugin can potentially allow a DoS attack

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here...

Apache Struts REST Plugin can potentially allow a DoS attack

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here...

Pippo Remote Code Execution Vulnerability

Pippo is a Java-based Web framework . A remote code execution vulnerability exists in Pippo 1.11.0 and earlier versions, which stems from the XstreamEngine component failing to use the defense mechanisms available to XStream to limit anti-grouping, and can be exploited by a remote attacker to...

CVE-2018-18240

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling...

Security Bulletin: Public disclosed vulnerability from Apache Struts affects IBM Platform Application Center.

Summary Public disclosed vulnerability from Apache Struts affects IBM Platform Application Center. Vulnerability Details CVEID: CVE-2018-1327 DESCRIPTION: Apache Struts is vulnerable to a denial of service. By sending a specially crafted XML request using the XStream handler with the Struts REST...

Security Bulletin: A vulnerability in Open Source BeanShell has been addressed by IBM Kenexa LMS (CVE-2016-2510)

Summary A vulnerability in Open Source BeanShell has been addressed by LMS Vulnerability Details CVEID: CVE-2016-2510 DESCRIPTION: BeanShell could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data using Java serialization or XStream. ...

Security Bulletin: IBM Tivoli Netcool Configuration Manager (ITNCM) is affected by a XStream vulnerability

Summary IBM Tivoli Netcool Configuration Manager ITNCM has addressed the following potential XStream vulnerability. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is vulnerable to a denial of service, caused by the improper handling of attempts to create an instance of the...

Security Bulletin: Open Source XStream as used in IBM QRadar SIEM is vulnerable to Denial of Service. (CVE-2017-7957)

Summary Open Source XStream is vulnerable to a Denial of Service attack. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is vulnerable to a denial of service, caused by the improper handling of attempts to create an instance of the primitive type 'void' during unmarshalling. A...

Security Bulletin: A vulnerability in XStream affects IBM InfoSphere Information Governance components

Summary A vulnerability in XStream was addressed by IBM InfoSphere Information Governance Catalog, IBM InfoSphere Information Server Business Glossary, and IBM InfoSphere Information Server Business Glossary Client for Eclipse. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is...

Remote code execution

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

CVE-2017-2608

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

CVE-2017-2608

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

CVE-2017-2608

CVE-2017-2608 is a remote-code-execution vulnerability in Jenkins via deserialization in XStream-based APIs (javax.imageio). Affected are Jenkins versions before 2.44 and 2.32.2 (as listed in multiple advisories). The flaw arises from improper validation of user-supplied input before deserializat...

CVE-2017-2608

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

Apache Struts REST Plugin XStream RCE

Remote command execution vulnerability in Apache Struts REST plugin XStream XML request Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Apache Struts2 REST Plugin XStream DoS (CVE-2017-9793) - Ver2

A vulnerability exists in Apache. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

Apache Struts XStream Handler REST Plugin XML Request Handling Remote DoS (S2-056)

The version of Apache Struts running on the remote host is prior to 2.5.16. It, therefore, contains a flaw in the REST plugin when using the XStream handler that is triggered during the handling of a specially crafted request with an XML payload. This may allow a remote attacker to cause a denial...

Denial Of Service (DoS)

Apache Struts REST plugin is vulnerable to denial of service DoS attacks. The application uses a version of the xstream library before version 1.4.10, which can crash when attempting to unmarshal void. This is related to CVE-2017-7957...

Apache Struts Denial of Service Vulnerability (CNVD-2018-06540)

Struts2 is Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . A denial of service vulnerability exists in Apache Struts2. Due to the Apache Struts2 REST plug-in , the use of XStream component on the XML...

CVE-2018-1327

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here...