Skip to content
OpenAdvisories

Vendor

xstream

3 known vulnerabilities.

Products

xstream 2 Woodstox 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.3
    CVE-2019-10173 EPSS 95%

    Deserialization of Untrusted Data and Code Injection in xstream

    It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML o…

    xstream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Maven