xstream:XmlFuzzer: Security exception in com.thoughtworks.xstream.converters.collections.PropertiesConverter.unmarshal

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=6445311384223744 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform

VMware on Tuesday shipped security updates to address a critical security flaw in its VMware Cloud Foundation product. Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring system, and relates to a remote code execution vulnerability via XStream open...

The vulnerability of the XStream library for converting objects to XML or JSON format in the VMware Cloud Foundation virtualization platform allows a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the XStream library for converting objects to XML or JSON format in the VMware Cloud Foundation platform is related to deserialization errors and the ability to execute arbitrary code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root...

VMware Cloud Foundation updates address multiple vulnerabilities.

3a. VMware Cloud Foundation update addresses a remote code execution vulnerability via XStream CVE-2021-39144 VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity rang...

VMware NSX Manager XStream unauthenticated RCE

VMware Cloud Foundation NSX-V contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Due to an unauthenticated endpoint that leverages XStream for...

Oracle WebCenter Sites (Oct 2022 CPU)

The 12.2.1.3.0 and 12.2.1.4.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: Centralized Thirdparty Jars...

VMSA-2022-0027:VMware Cloud Foundation updates address multiple vulnerabilities

Advisory ID: VMSA-2022-0027.2 CVSSv3 Range: 5.3-9.8 Issue Date:2022-10-25 Updated On: 2023-03-09 CVEs: CVE-2021-39144, CVE-2022-31678 Synopsis: VMware Cloud Foundation updates address multiple vulnerabilities. RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacted...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to denial of service due to XStream (CVE-2021-43859)

Summary IBM Sterilng B2B Integrator has addressed a security vulnerabilitiy in XStream. Vulnerability Details CVEID:CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker...

CVE-2022-40156

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40155

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40153

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

CVE-2022-40151

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization...

xstream:XmlFuzzer: Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5219006592450560 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

CVE-2022-40154

A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service DoS in its target...

Denial Of Service (DoS)

XStream Core is vulnerable to denial of service. The vulnerability exist due to a stack overflow during the serialization of xml data which allows an attacker to parse malicious input causing an application crash...

Denial Of Service (DoS)

XStream Core is vulnerable to denial of service. The vulnerability exist due to a stack overflow during the serialization of xml data which allows an attacker to parse malicious input causing an application crash...

Denial Of Service (DoS)

xstream is vulnerable to denial of service. The vulnerability exists due to the stack overflow in the processConverterAnnotations function of AnnotationMapper.java, allowing an attacker to cause an application crash by providing malicious input through the parser...

Denial Of Service (DoS)

xstream is vulnerable to denial of service. The vulnerability exists due to the stack overflow in the processConverterAnnotations function of AnnotationMapper.java, allowing an attacker to cause an application crash by providing malicious input through the parser...

Denial Of Service (DoS)

xstream is vulnerable to Denial Of Service DoS. The vulnerability exists due to the stack overflow in the processConverterAnnotations function of AnnotationMapper.java, allowing an attacker to cause an application crash by providing malicious input through the parser...

xstream:XmlFuzzer: Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=4759518994628608 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...