ROOT-APP-MAVEN-CVE-2022-41966 CVE-2022-41966 in io.root.com.thoughtworks.xstream:xstream - Patched by Root

Root has patched CVE-2022-41966 in the io.root.com.thoughtworks.xstream:xstream package for Root:Maven. Multiple fixed versions available...

xstream:XmlFuzzer: Security exception in java.base/java.lang.AbstractStringBuilder.<init>

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5387224991727616 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Unity Linux 20.1070e Security Update: xstream (UTSA-2026-016761)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016761 advisory. XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

Oinone-Pamirs code issue vulnerabilities

Oinone-Pamirs is an AI-driven low-code development framework developed by Oinone. Version 7.0.0 of Oinone-Pamirs contains code vulnerabilities. These vulnerabilities stem from the XML parsing logic based on XStream. When attacker-controlled XML is passed to the framework’s parsing points, such as...

EUVD-2026-30548

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

PT-2026-41305

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity XXE issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML... or ViewXmlUtils.fromXML..., unsafe XML processing can lead to file disclosure or SSRF...

Unity Linux 20.1070e Security Update: xstream (UTSA-2026-017781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017781 advisory. XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficien...

Unity Linux 20.1070e Security Update: xstream (UTSA-2026-017732)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017732 advisory. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated...

Unity Linux 20.1070e Security Update: xstream (UTSA-2026-017728)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017728 advisory. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host...

RHCOS 3 : OpenShift Container Platform 3.11.685 (RHSA-2022:1420)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1420 advisory. - xstream: Injecting highly recursive collections or maps can cause a DoS CVE-2021-43859 - workflow-cps: OS command execution throug...

xstream:XmlFuzzer: Security exception in java.base/java.lang.AbstractStringBuilder.<init>

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5030804760887296 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208 — Mirth Connect Pre-Auth RCE Pre-authenticated...

VulnCheck KEV: CVE-2021-39152

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. ...

Security Bulletin: IBM® Db2® is affected by the vulnerability in xstream-1.4.20.jar ( CVE-2024-47072)

Summary IBM® Db2® is affected by the vulnerability in xstream-1.4.20.jar. Vulnerability Details CVEID:CVE-2024-47072 DESCRIPTION: XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overfl...

MiracleLinux 7 : xstream-1.3.1-14.el7 (AXSA:2021-2208:03)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-2208:03 advisory. XStream: remote command execution attack by manipulating the processed input stream CVE-2021-29505 Tenable has extracted the preceding description block...