pippo records
5 published records for vendor pippo.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 80%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-502 Deserialization of Untrusted Data2
- CWE-20 Improper Input Validation1
- CWE-611 Improper Restriction of XML External Entity Reference1
- CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
51Plan | CVE-2017-18349Proof of concept | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbipippo · pippo · CWE-20 | Critical9.8 | — | 38.8% | Oct 23, 2018 |
41Plan | CVE-2018-18628No exploit | An issue was discovered in Pippo 1.11.0.pippo · pippo · CWE-502 | Critical9.8 | — | 5.4% | Oct 23, 2018 |
40Plan | CVE-2018-18240No exploit | Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not usepippo · pippo · CWE-502 | Critical9.8 | — | 3.6% | Oct 11, 2018 |
39Monitor | CVE-2018-20059No exploit | jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.pippo · pippo · CWE-611 | Critical9.8 | — | 1.5% | Dec 11, 2018 |
30Monitor | CVE-2019-5442No exploit | XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountspippo · pippo · CWE-776 | High7.5 | — | 1.4% | Jun 12, 2019 |
- CVE-2017-1834951Plan
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbi
CriticalCVSS 9.8Proof of conceptEPSS 38%pippo · pippoOct 23, 2018
- CVE-2018-1862841Plan
An issue was discovered in Pippo 1.11.0.
CriticalCVSS 9.8No exploitEPSS 5%pippo · pippoOct 23, 2018
- CVE-2018-1824040Plan
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use
CriticalCVSS 9.8No exploitEPSS 3%pippo · pippoOct 11, 2018
- CVE-2018-2005939Monitor
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
CriticalCVSS 9.8No exploitEPSS 1%pippo · pippoDec 11, 2018
- CVE-2019-544230Monitor
XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts
HighCVSS 7.5No exploitEPSS 1%pippo · pippoJun 12, 2019