PatchTheCVEpippo vulnerabilities
Recent CVEs affecting pippo products. 5 tracked.
pippo has 5 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 2. Most recent: 2019-06-12. Highest priority: CVE-2017-18349 (score 69/100).
- CVE-2019-5442 HIGH 7.5 DOWNGRADE XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created
- CVE-2018-20059 CRITICAL 9.8 DOWNGRADE jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
- CVE-2018-18628 CRITICAL 9.8 DOWNGRADE An issue was discovered in Pippo 1.11.0
- CVE-2018-18240 CRITICAL 9.8 UPGRADE Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the Xstrea
- CVE-2017-18349 CRITICAL 9.8 UPGRADE DOWNGRADE parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows re
FAQ
How do I fix pippo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pippo being exploited right now?
None of the tracked pippo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pippo CVE should I patch first?
CVE-2017-18349 currently ranks highest (69/100): parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows re.