https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:24:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-02936 bdu:2019-02936 https://cve.radiocsirt.org/vuln/bdu:2019-02936 https://cve.radiocsirt.org/vuln/certfr-2019-avi-586 certfr-2019-avi-586 https://cve.radiocsirt.org/vuln/certfr-2019-avi-586 https://cve.radiocsirt.org/vuln/cnvd-2019-24004 cnvd-2019-24004 https://cve.radiocsirt.org/vuln/cnvd-2019-24004 https://cve.radiocsirt.org/vuln/euvd-2026-53405 EUVD-2026-53405 https://cve.radiocsirt.org/vuln/euvd-2026-53405 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10173 <p>It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)</p> <p>It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-10173 https://cve.radiocsirt.org/vuln/ghsa-hf23-9pf7-388p <p><strong>Affected:</strong> Maven: com.thoughtworks.xstream:xstream</p> <p>It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)</p> <p><strong>Affected:</strong> Maven: com.thoughtworks.xstream:xstream</p> <p>It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)</p> https://cve.radiocsirt.org/vuln/ghsa-hf23-9pf7-388p https://cve.radiocsirt.org/vuln/gsd-2019-10173 gsd-2019-10173 https://cve.radiocsirt.org/vuln/gsd-2019-10173 https://cve.radiocsirt.org/vuln/rhsa-2019:1822 <p>jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: exfiltration/XXE in some JDK classes jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)</p> <p>jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: exfiltration/XXE in some JDK classes jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)</p> https://cve.radiocsirt.org/vuln/rhsa-2019:1822 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-10173 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: libxstream-java</p> <p>It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: libxstream-java</p> <p>It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-10173 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1689 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1689