XStream vulnerabilities

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to request data from internal resources not publicly available by manipulating the processed input stream with Java runtime version 14 to 8. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. If relying on the default blacklist of the Security Framework, you must use at least version 1.4.18.

XStream, a library for serializing objects to and from XML, in affected versions may allow a remote attacker to allocate 100% CPU time on the target system by manipulating the processed input stream, resulting in a denial of service. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. Users who configured the security framework with a whitelist are not affected. Version 1.4.18 no longer uses a blacklist by default.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

Vulnerability in XStream in affected versions allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users following the whitelist recommendation are not affected.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below, but the scenario can be adjusted to an external Xalan that works regardless of Java runtime version. Users who configured the security framework with a whitelist are not affected. Version 1.4.18 no longer uses a blacklist by default.

Vulnerability in XStream before version 1.4.17 allows a remote attacker with sufficient rights to execute commands on the host by manipulating the processed input stream. Users following the whitelist recommendation are not affected.

XStream before 1.4.16 contains a vulnerability allowing a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users with a whitelist of minimal types are not affected.

XStream before version 1.4.16 allows a remote attacker to execute arbitrary code by manipulating the processed input stream. Users who configured a whitelist of allowed types are not affected.

XStream before version 1.4.16 allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream. Users who configured a whitelist of allowed types are not affected.

XStream before version 1.4.16 allows a remote attacker to occupy a thread that consumes maximum CPU time and will never return. Users who configured a whitelist of allowed types are not affected.

XStream before version 1.4.16 allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured a whitelist of allowed types are not affected.

XStream before 1.4.16 contains a vulnerability allowing a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users with a whitelist of minimal types are not affected.

XStream before version 1.4.16 allows a remote attacker with sufficient rights to execute commands on the host by manipulating the processed input stream. Users who configured the security framework with a whitelist limited to the minimal required types are not affected.

XStream before 1.4.16 contains a vulnerability allowing a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users with a whitelist of minimal types are not affected.

XStream before version 1.4.16 contains a vulnerability where the processed stream at unmarshalling time contains type information to recreate previously written objects. An attacker can manipulate the processed input stream and replace or inject objects, resulting in the deletion of a file on the local host.

XStream before version 1.4.16 contains a vulnerability where the processed stream at unmarshalling time contains type information to recreate previously written objects. An attacker can manipulate the processed input stream and replace or inject objects, resulting in a server-side request forgery.

Vulnerability in XStream before version 1.4.16 allows an attacker to allocate 100% CPU time on the target system, leading to denial of service. Users relying on the default blacklist of the Security Framework are affected.

XStream before 1.4.15 is vulnerable to arbitrary file deletion on the local host during unmarshalling. A remote attacker can delete known files if the process has sufficient rights by manipulating the processed input stream.

XStream before 1.4.15 contains a Server-Side Request Forgery (SSRF) vulnerability activated during unmarshalling. A remote attacker can request data from internal resources not publicly available by manipulating the processed input stream.

Vulnerability in XStream before version 1.4.14 allows remote code execution. An attacker can run arbitrary shell commands by manipulating the processed input stream. Only users relying on blocklists are affected.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. Users who configured the security framework with a whitelist are not affected. If relying on XStream's default blacklist, you must use at least version 1.4.18.