x-stream__xstream_CVE-2013-7285_1-4-6

XStream "Java to XML Serialization, and back again" -- Binaries ----------------------------------------------- All binary artifacts are in the 'lib' directory. These include the xstream jars and any other library used at build time, or optional runtime extras. kXML2 is recommend for use as it...

XStream <1.4.6/1.4.10 - Remote Code Execution

Xstream API before 1.4.6 and 1.4.10 is susceptible to remote code execution. If the security framework has not been initialized, an attacker can run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. This can allow an attacker to...

SUSE CVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON...

Mageia: Security Advisory (MGASA-2014-0100)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Deserialization of untrusted data

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON...

Remote Code Execution (RCE)

XStream is vulnerable to remote code execution. The vulnerability exists due to the regression of security vulnerability CVE-2013-7285, allowing a remote attacker to trigger RCE during unmarshaling XML or any supported format...

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

Important: Red Hat Security Advisory: Red Hat Process Automation Manager 7.4.0 Security Update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CVE-2019-10173

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

ai.mattmann.mnemosyne:cas-crawler (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:cas-pge (>=1.11.0, <=1.13.8) +3938 more potentially affected by CVE-2013-7285 via com.thoughtworks.xstream:xstream (>=1.1.1, <=1.4.6)

com.thoughtworks.xstream:xstream MAVEN version =1.1.1, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =0.3.3, =0.4.0, =2.0-beta-3, =1.0, =4.0.0, =4.0.1 and more Source cves: CVE-2013-7285 Source advisory: OSV:GHSA-F554-X222-WGF7...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.5), ai.hyacinth.framework:core-service-discovery-server (>=0.5.0, <=0.5.5) +1917 more potentially affected by CVE-2013-7285 via com.thoughtworks.xstream:xstream (1.4.10)

com.thoughtworks.xstream:xstream MAVEN version 1.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.thoughtworks.xstream:xstream and may be impacted: - ai.hyacinth.framework:core-service-admin-server =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0,...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.5), ai.hyacinth.framework:core-service-discovery-server (>=0.5.0, <=0.5.5) +1924 more potentially affected by CVE-2013-7285 via com.thoughtworks.xstream:xstream (>=1.4.10, <=1.4.10-java7)

com.thoughtworks.xstream:xstream MAVEN version =1.4.10, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =finchley.sr4, =1.0.0.release, =1.1.0.release, =1.0.0.release, =1.1.1.release, =4.3.0-beta-1, =0.9.0-rc1, =0.9.0-rc1, =0.9.0-rc1, =0.9.1 and more Source cves: CVE-2013-7285 Source advisory:...

CVE-2013-7285

creationtimestamp| type| source ---|---|--- 2019-05-15 20:33:21+00:00| seen| https://t.me/cibsecurity/4332 2021-03-16 11:01:03+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2917 2026-09-01 17:00:58+00:00| seen| https://t.me/cissp/2547 2026-09-02 01:04:49+00:00| seen|...

CVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.5), ai.hyacinth.framework:core-service-discovery-server (>=0.5.0, <=0.5.5) +1924 more potentially affected by CVE-2013-7285 via com.thoughtworks.xstream:xstream (>=1.4.10, <=1.4.10-java7)

com.thoughtworks.xstream:xstream MAVEN version =1.4.10, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =finchley.sr4, =1.0.0.release, =1.1.0.release, =1.0.0.release, =1.1.1.release, =4.3.0-beta-1, =0.9.0-rc1, =0.9.0-rc1, =0.9.0-rc1, =0.9.1 and more Source cves: CVE-2013-7285 Source advisory:...

ai.mattmann.mnemosyne:cas-crawler (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:cas-pge (>=1.11.0, <=1.13.8) +3938 more potentially affected by CVE-2013-7285 via com.thoughtworks.xstream:xstream (>=1.1.1, <=1.4.6)

com.thoughtworks.xstream:xstream MAVEN version =1.1.1, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =0.3.3, =0.4.0, =2.0-beta-3, =1.0, =4.0.0, =4.0.1 and more Source cves: CVE-2013-7285 Source advisory: MEND:CVE-2013-7285...

CVE-2013-7285

CVE-2013-7285: XStream API (versions up to 1.4.6 and 1.4.10) may allow remote code execution if the security framework is not initialized during unmarshalling of XML/JSON streams. IBM’s bulletin for IBM Storage Copy Data Management cites this as a vulnerability affecting 2.2.x releases and instru...