Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2020-36184

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

CVSS 3.1 · 8.8 High EPSS 8.4% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 58 more
CVE-2020-10672

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 38 more
CVE-2020-11112

jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

CVSS 3.1 · 8.8 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 37 more
CVE-2020-11113

jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 39 more
CVE-2020-14061

jackson-databind: serialization in weblogic/oracle-aqjms

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

CVSS 3.1 · 8.1 High EPSS 4.5% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 17 more