Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 305

Export CSV
CVE-2019-14893

jackson-databind: Serialization gadgets in classes of the xalan package

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed
Vendors
Fasterxml Netapp Oracle and 1 more
Products
Jackson-databind Oncommand Api Services Steelstore Cloud Integrated Storage and 9 more
CVE-2019-10219

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Element Management Services For Element Software And Netapp Hci and 195 more
CVE-2019-10086

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS 3.1 · 7.3 High EPSS 29.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Commons Beanutils Nifi Debian Linux and 70 more
CVE-2017-7525

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVSS 3.1 · 9.8 Critical EPSS 37.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Oncommand Balance and 27 more
CVE-2017-5645

log4j: Socket receiver deserialization vulnerability

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 89.4% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Log4j Oncommand Api Services Oncommand Insight and 83 more
CVE-2019-16942

jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Debian Fasterxml Fedoraproject and 3 more
Products
Debian Linux Jackson-databind Fedora and 34 more
CVE-2019-16335

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

CVSS 3.1 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Debian Fasterxml Fedoraproject and 3 more
Products
Debian Linux Jackson-databind Fedora and 23 more
CVE-2019-14892

jackson-databind: Serialization gadgets in classes of the commons-configuration package

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 5.6% KEV · Not listed
Vendors
Apache Fasterxml Redhat
Products
Geode Jackson-databind Decision Manager and 10 more
CVE-2019-14379

jackson-databind: default typing mishandling leading to remote code execution

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.0% KEV · Not listed
Vendors
Apple Debian Fasterxml and 4 more
Products
Xcode Debian Linux Jackson-databind and 34 more
CVE-2018-14719

jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

CVSS 3.1 · 9.8 Critical EPSS 9.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Oncommand Workflow Automation and 28 more
CVE-2018-12022

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

CVSS 3.1 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Debian Fasterxml Fedoraproject and 2 more
Products
Debian Linux Jackson-databind Fedora and 17 more
CVE-2018-11307

jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Fasterxml Oracle Redhat
Products
Jackson-databind Clusterware Communications Instant Messaging Server and 15 more
CVE-2013-7285

XStream: remote code execution due to insecure XML deserialization

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

CVSS 3.1 · 9.8 Critical EPSS 84.4% KEV · Not listed
Vendors
Apache Oracle Redhat and 1 more
Products
Activemq Endeca Information Discovery Studio Fuse Esb Enterprise and 14 more
CVE-2020-25649

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

CVSS 3.1 · 7.5 High EPSS 17.7% KEV · Not listed
Vendors
Apache Fasterxml Fedoraproject and 4 more
Products
Iotdb Jackson-databind Fedora and 47 more
CVE-2020-11619

jackson-databind: Serialization gadgets in org.springframework:spring-aop

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 28 more