https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T22:19:55.400021+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2020-00052 bdu:2020-00052 2026-09-30T22:19:56.705601+00:00 bdu:2020-00052 https://vulnerability.circl.lu/vuln/fkie_cve-2018-17200 fkie_cve-2018-17200 2026-09-30T22:19:56.705689+00:00

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019

 https://vulnerability.circl.lu/vuln/ghsa-rv9j-p5m2-3523 GHSA-rv9j-p5m2-3523 2026-09-30T22:19:56.705759+00:00

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019

 https://vulnerability.circl.lu/vuln/gsd-2018-17200 gsd-2018-17200 2026-09-30T22:19:56.705794+00:00 gsd-2018-17200