The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2683 advisory.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of xstream installed on the remote host is prior to 1.3.1-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1698 advisory.

    A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to     obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-29505)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2683 advisory.

    XStream is a Java XML serialization library to serialize objects to and deserialize object from XML.

    Security Fix(es):

    * XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is affected by multiple vulnerabilities.

  - Component: WebCenter Sites (Terracotta Quartz Scheduler)). The supported   versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to   compromise Oracle WebCenter Sites. Successful attacks of this vulnerability   can result in takeover of Oracle WebCenter Sites. (CVE-2019-13990)

  - Component: WebCenter Sites (XStream)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows low privileged attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in takeover of Oracle WebCenter Sites. (CVE-2021-29505)

  - Component: WebCenter Sites (dojo)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows unauthenticated attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in unauthorized creation, deletion or modification access to critical data or   all Oracle WebCenter Sites accessible data. (CVE-2020-5258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus relies on the presence of the package as reported by the vendor.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Guest     Management (XStream)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-29505)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager Ops Center     (component: Common Core (XStream)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-21345) 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2704 advisory.

    A vulnerability in XStream, a Java library to serialize objects to and from XML, may allow a remote     attacker to execute commands of the host only by manipulating the processed input stream. Note: the     XStream project recommends to setup its security framework with a whitelist limited to the minimal     required types, rather than relying on the black list (which got updated to address this vulnerability).
    The project is also phasing out maintainance of the black list, see     https://x-stream.github.io/security.html . For Debian 9 stretch, this problem has been fixed in version     1.4.11.1-1+deb9u3. We recommend that you upgrade your libxstream-java packages. For the detailed security     status of libxstream-java please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libxstream-java Further information about Debian LTS security advisories, how     to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2021 Critical Patch Update (CPU). It is, therefore, affected by a vulnerability in the Discussion Forums (XStream) component that is easily exploitable by a remote, low privileged attacker to compromise Oracle WebCenter Portal's confidentiality, integrity and availability.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017781 advisory.

    XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0911-1 advisory.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2683 advisory.

    [1.3.1-14]
    - Fix remote code execution vulnerability
    - Resolves: CVE-2021-29505

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
151614	CentOS 7 : xstream (RHSA-2021:2683)	Nessus	CentOS Local Security Checks	2021/7/13	2024/10/9	high
152234	Amazon Linux 2 : xstream (ALAS-2021-1698)	Nessus	Amazon Linux Local Security Checks	2021/8/6	2024/12/11	high
151493	RHEL 7 : xstream (RHSA-2021:2683)	Nessus	Red Hat Local Security Checks	2021/7/12	2024/11/7	high
154418	Oracle WebCenter Sites Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Windows	2021/10/26	2023/11/28	critical
257158	Linux Distros Unpatched Vulnerability : CVE-2021-29505	Nessus	Misc.	2025/8/27	2025/8/27	high
170201	Oracle Enterprise Manager Ops Center UI and Other Patches (Oct 2021 CPU)	Nessus	Misc.	2023/1/20	2023/9/7	critical
151373	Debian DLA-2704-1 : libxstream-java - LTS security update	Nessus	Debian Local Security Checks	2021/7/5	2025/1/24	high
154326	Oracle WebCenter Portal RCE (Oct 2021 CPU)	Nessus	Misc.	2021/10/21	2022/4/11	high
314143	Unity Linux 20.1070e Security Update: xstream (UTSA-2026-017781)	Nessus	Unity Linux Local Security Checks	2026/5/11	2026/5/11	high
151061	openSUSE 15 Security Update : xstream (openSUSE-SU-2021:0911-1)	Nessus	SuSE Local Security Checks	2021/6/28	2021/6/28	high
151505	Oracle Linux 7 : xstream (ELSA-2021-2683)	Nessus	Oracle Linux Local Security Checks	2021/7/12	2024/11/1	high

检测

插件搜索

high

high

high

critical

high

critical

high

high

high

high

high