Skip to content

Vendor

exadel vulnerabilities

3 published CVES affecting exadel, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
2
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of exadel alerts

Products

Latest exadel CVEs

Newest publication first

  1. CVE-2017-3206 The Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages

    Published
    CriticalCVSS 9.8 EPSS 3.6%

    The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data...

  3. CVE-2017-3202 The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control

    Published
    CriticalCVSS 9.8 EPSS 8.1%

    The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.