CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
XStream XML Deserialization Remote Code Execution Vulnerability (CVE-2021-39144) Security Advisory
[Affected Scope] Java applications utilizing XStream library versions prior to 1.4.18, and third-party solutions like VMware NSX Manager embedding this library
[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by manipulating the processed XML input stream
[Mitigation] Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist
Zimbra Collaboration Suite ProxyServlet Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-9621) Analysis and Mitigation Guide
[Affected Scope] Zimbra Collaboration Suite before 8.6 Patch 13, 8.7.x before 8.7.11 Patch 10, and 8.8.x before 8.8.10 Patch 7 or 8.8.x before 8.8.11 Patch 3
[Impact] Unauthenticated remote attackers can exploit the ProxyServlet to access internal network resources, or chain it with other vulnerabilities (such as XXE) to steal admin credentials and achieve Remote Code Execution (RCE).
[Mitigation] Immediately apply the official security patches corresponding to your Zimbra version and restrict external access to the ProxyServlet endpoint.