NVD disclosure day
CVE-2021-21351
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the XStream Java library could allow remote attackers to execute arbitrary code by manipulating input streams. This is a critical risk for applications processing untrusted XML data, especially if XStream's security framework is not configured with a restrictive whitelist. Confirming XStream usage an
CVE-2021-21350
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the XStream Java library allows remote attackers to execute arbitrary code by manipulating input streams. This impacts users relying on XStream's default security blacklist, necessitating an update to at least version 1.4.16.
CVE-2021-21347
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the XStream Java library may allow a remote attacker to execute arbitrary code by manipulating input streams. This could impact systems using XStream's default security configuration, potentially affecting system data and services. Readers should confirm XStream usage and assess exposure.
CVE-2021-21346
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the XStream Java library enables remote attackers to execute arbitrary code by manipulating input streams, affecting systems that do not use a strict security whitelist. This could lead to compromised system data and application integrity.
CVE-2021-21345
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the XStream Java serialization library may allow a remote attacker to execute host commands by manipulating processed input. Users who rely on XStream's default security settings are vulnerable if they have not updated to a patched version.
CVE-2021-21344
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in the XStream Java serialization library allows remote attackers to execute arbitrary code by manipulating input streams. This risk is amplified when XStream's security framework is not configured with a restrictive whitelist, potentially impacting applications that process untrusted XML input
CVE-2021-21342
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The XStream Java library has a vulnerability that allows for server-side request forgery when processing untrusted XML input. An attacker can manipulate the input stream to inject or replace objects during deserialization, leading to the execution of arbitrary code if XStream's security framework is not properly config