Exploit for OS Command Injection in Xstream

Description XStream can be used for Remote Code Execution...

Exploit for OS Command Injection in Apache Struts

Description XStream is vulnerable to an Arbitrary File Delet...

Exploit for Server-Side Request Forgery in Apache Struts

Description XStream is a Java library to serialize objects t...

Security update for xstream (important)

openSUSE Security Update: Security update for xstream Announcement ID: openSUSE-SU-2021:0140-1 Rating: important References: 1180145 1180146 1180994 Cross-References: CVE-2020-26217 CVE-2020-26258 CVE-2020-26259 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities is n...

SUSE-SU-2021:0176-1 Security update for xstream

This update for xstream fixes the following issues: xstream was updated to version 1.4.15. - CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists bsc1180994. - CVE-2020-26258: Fixed a server-side request forgery vulnerability bsc1180146. -...

Vulnerability fixed in XStream

A vulnerability has been fixed in XStream. When it is possible for a user is able to submit XML files to the application delivery, the vulnerability could potentially be exploited to execute shell commands under application privileges. Only applications using the default blacklist functionality,...

xstream security update

1.3.1-12 - Rebuild with OpenJDK 7 1.3.1-11 - Fix remote code execution vulnerability - Resolves: CVE-2020-26217...

RHEL 7 : xstream (RHSA-2021:0162)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0162 advisory. XStream is a Java XML serialization library to serialize objects to and deserialize object from XML. Security Fixes: XStream: remote code execution d...

Oracle Linux 7 : xstream (ELSA-2021-0162)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0162 advisory. 1.3.1-12 - Rebuild with OpenJDK 7 1.3.1-11 - Fix remote code execution vulnerability - Resolves: CVE-2020-26217 Tenable has extracted the preceding description...

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

Important: Red Hat Security Advisory: xstream security update

An update for xstream is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

Important: Red Hat Security Advisory: Red Hat Process Automation Manager 7.9.1 security update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

Important: Red Hat Security Advisory: Red Hat Decision Manager 7.9.1 security update

An update is now available for Red Hat Decision Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...

Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)

Summary There are multiple vulnerabilities identified in IBM Guardium Data Encryption GDE. These vulnerabilities have been fixed in GDE 4.0.0.4. Please apply the latest version for the fixes. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is vulnerable to a denial of service,...

[SECURITY] [DSA 4828-1] libxstream-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4828-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 07, 2021 https://www.debian.org/security/faq -...

Debian DLA-2507-1 : libxstream-java security update

Several security vulnerabilities were discovered in XStream, a Java library to serialize objects to XML and back again. CVE-2020-26258 XStream is vulnerable to a Server-Side Forgery Request which can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data fr...

Debian: Security Advisory (DLA-2507-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2507-1] libxstream-java security update

Debian LTS Advisory DLA-2507-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany December 31, 2020 https://wiki.debian.org/LTS Package : libxstream-java Version : 1.4.11.1-1+deb9u1 CVE ID : CVE-2020-26258 CVE-2020-26259 Debian Bug : 977625 977624 Several security...