CVE-2018-1131

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

• CWE-349
• CWE-502

• http://www.securityfocus.com/bid/104218Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1833Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3892
• https://bugzilla.redhat.com/show_bug.cgi?id=1576492Issue Tracking, Third Party Advisory
• http://www.securityfocus.com/bid/104218Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1833Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3892
• https://bugzilla.redhat.com/show_bug.cgi?id=1576492Issue Tracking, Third Party Advisory

Published

May 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11303Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-11304Possible buffer overflow in msm_adsp_stream_callback_put due…
• CVE-2018-11305When a series of FDAL messages are sent to the modem, a Use …
• CVE-2018-11306Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-11307An issue was discovered in FasterXML jackson-databind 2.0.0 …9.8
• CVE-2018-11309Blind SQL injection in coupon_code in the MemberMouse plugin…
• CVE-2018-11311A hardcoded FTP username of myscada and password of Vikuk63 …
• CVE-2018-11314The External Control API in Roku and Roku TV products allow …
• CVE-2018-11315The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84…
• CVE-2018-11316The UPnP HTTP server on Sonos wireless speaker products allo…
• CVE-2018-11317Subrion CMS before 4.1.4 has XSS.
• CVE-2018-11319Syntastic (aka vim-syntastic) through 3.9.0 does not properl…