VMware Cloud Foundation has a significant RCE flaw

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A Remote Code Execution RCE vulnerability through the XStream open-source library tagged as CVE-2021-39144 in the VMware Cloud Foundation, which is a hybrid cloud platform for hosting enterprise...

VMware NSX for vSphere (NSX-v) < 6.4.14 Multiple Vulnerabilities (VMSA-2022-0027)

The version of VMware NSX for vSphere NSX-V installed on the remote host is prior to 6.4.14. It is, therefore, affected by multiple vulnerabilities, including: - VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. CVE-2021-39144 - VMware Cloud...

CVE-2021-39144: VMware Cloud Foundation Unauthenticated Remote Code Execution

On October 25, 2022, VMware published VMSA-2022-0027 on two vulnerabilities in its Cloud Foundation NSX-V solution. By far the more severe of these is CVE-2021-39144, an unauthenticated remote code execution vulnerability with a CVSSv3 score of 9.8. The vulnerability arises from a deserialization...

VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform

VMware on Tuesday shipped security updates to address a critical security flaw in its VMware Cloud Foundation product. Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring system, and relates to a remote code execution vulnerability via XStream open...

The vulnerability of the XStream library for converting objects to XML or JSON format in the VMware Cloud Foundation virtualization platform allows a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the XStream library for converting objects to XML or JSON format in the VMware Cloud Foundation platform is related to deserialization errors and the ability to execute arbitrary code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root...

VMware Cloud Foundation updates address multiple vulnerabilities.

3a. VMware Cloud Foundation update addresses a remote code execution vulnerability via XStream CVE-2021-39144 VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity rang...

Oracle WebCenter Sites (Oct 2022 CPU)

The 12.2.1.3.0 and 12.2.1.4.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: Centralized Thirdparty Jars...

VMSA-2022-0027:VMware Cloud Foundation updates address multiple vulnerabilities

Advisory ID: VMSA-2022-0027.2 CVSSv3 Range: 5.3-9.8 Issue Date:2022-10-25 Updated On: 2023-03-09 CVEs: CVE-2021-39144, CVE-2022-31678 Synopsis: VMware Cloud Foundation updates address multiple vulnerabilities. RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacted...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to denial of service due to XStream (CVE-2021-43859)

Summary IBM Sterilng B2B Integrator has addressed a security vulnerabilitiy in XStream. Vulnerability Details CVEID:CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker...

CVE-2022-40156

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40155

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40153

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40151

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40154

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target...

Denial Of Service (DoS)

XStream Core is vulnerable to denial of service. The vulnerability exist due to a stack overflow during the serialization of xml data which allows an attacker to parse malicious input causing an application crash...

Denial Of Service (DoS)

XStream Core is vulnerable to denial of service. The vulnerability exist due to a stack overflow during the serialization of xml data which allows an attacker to parse malicious input causing an application crash...

Denial Of Service (DoS)

xstream is vulnerable to denial of service. The vulnerability exists due to the stack overflow in the processConverterAnnotations function of AnnotationMapper.java, allowing an attacker to cause an application crash by providing malicious input through the parser...

Denial Of Service (DoS)

xstream is vulnerable to denial of service. The vulnerability exists due to the stack overflow in the processConverterAnnotations function of AnnotationMapper.java, allowing an attacker to cause an application crash by providing malicious input through the parser...

Denial Of Service (DoS)

xstream is vulnerable to Denial Of Service DoS. The vulnerability exists due to the stack overflow in the processConverterAnnotations function of AnnotationMapper.java, allowing an attacker to cause an application crash by providing malicious input through the parser...

GHSA-3MQ5-FQ9H-GJ7J Duplicate Advisory: Denial of Service due to parser crash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8cc-g7j8-xxpm. This link is maintained to preserve external references. Original Description Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running...