● CVE — Critical
CVE-2019-10173
Vendorxstream, oracleProductxstream, communications unified inventory management, webcenter portal, banking platform, endeca information discovery studio, communications diameter signaling router, retail xstore point of service, utilities framework, business activity monitoring, communications billing and revenue management elastic charging engineDiscoveredJul 23, 2019UpdatedMay 14, 2025
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)