Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 96

Export CSV
CVE-2020-36189

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

CVSS 3.1 · 8.1 High EPSS 4.0% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 39 more
CVE-2020-36188

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1 · 8.1 High EPSS 8.8% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 44 more
CVE-2020-36187

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 44 more
CVE-2020-36186

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 44 more
CVE-2020-36185

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 44 more
CVE-2020-36183

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

CVSS 3.1 · 8.1 High EPSS 5.0% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 44 more
CVE-2020-35491

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 7.8% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Service Level Manager and 25 more
CVE-2020-35490

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 6.3% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Service Level Manager and 24 more
CVE-2020-24750

jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

CVSS 3.1 · 8.1 High EPSS 7.3% KEV · Not listed
Vendors
Debian Fasterxml Oracle and 1 more
Products
Debian Linux Jackson-databind Agile Product Lifecycle Management and 26 more
CVE-2020-24616

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

CVSS 3.1 · 8.1 High EPSS 7.6% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 1 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 22 more
CVE-2020-14062

jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

CVSS 3.1 · 8.1 High EPSS 8.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 15 more
CVE-2020-14060

jackson-databind: serialization in oadd.org.apache.xalan.lib.sql.JNDIConnectionPool

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

CVSS 3.1 · 8.1 High EPSS 8.6% KEV · Not listed
Vendors
Fasterxml Netapp Oracle and 1 more
Products
Jackson-databind Active Iq Unified Manager Steelstore Cloud Integrated Storage and 14 more
CVE-2019-14439

jackson-databind: Polymorphic typing issue related to logback/JNDI

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

CVSS 3.1 · 7.5 High EPSS 10.8% KEV · Not listed
Vendors
Apache Debian Fasterxml and 3 more
Products
Drill Debian Linux Jackson-databind and 17 more
CVE-2019-14379

jackson-databind: default typing mishandling leading to remote code execution

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.0% KEV · Not listed
Vendors
Apple Debian Fasterxml and 4 more
Products
Xcode Debian Linux Jackson-databind and 34 more
CVE-2020-11619

jackson-databind: Serialization gadgets in org.springframework:spring-aop

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 28 more
CVE-2020-9546

jackson-databind: Serialization gadgets in shaded-hikari-config

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVSS 3.1 · 9.8 Critical EPSS 4.6% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 39 more
CVE-2020-10672

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 38 more
CVE-2020-14061

jackson-databind: serialization in weblogic/oracle-aqjms

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

CVSS 3.1 · 8.1 High EPSS 4.5% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 17 more
CVE-2020-36179

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1 · 8.8 High EPSS 17.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 56 more