XML External Entity Injection in XStream

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-3674 · ADVISORY
• x-stream/xstream · WEB
• x-stream/xstream · PACKAGE
• snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385 · WEB
• lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html · WEB
• lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html · WEB
• rhn.redhat.com/errata/RHSA-2016-2822.html · WEB
• rhn.redhat.com/errata/RHSA-2016-2823.html · WEB
• debian.org/security/2016/dsa-3575 · WEB
• openwall.com/lists/oss-security/2016/03/25/8 · WEB
• openwall.com/lists/oss-security/2016/03/28/1 · WEB
• securityfocus.com/bid/85381

Autres vulnérabilités de com.thoughtworks.xstream:xstream

• CVE-2024-47072ÉLEVÉE 7.5XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the appl…
• CVE-2022-41966ÉLEVÉE 7.5XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application wit…
• CVE-2022-40151ÉLEVÉE 7.5Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied inp…
• CVE-2021-43859ÉLEVÉE 7.5XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to a…
• CVE-2021-39152ÉLEVÉE 8.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker …