416 matches found
CLEANSTART-2026-FF14094 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
CLEANSTART-2026-ES07663 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
PT-2026-108452
Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...
PT-2026-108400
Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
PT-2026-108517
Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
PT-2026-108391
Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
CVE-2026-59281
A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...
CVE-2026-59282
A flaw was found in Spring Framework. Applications utilizing Spring's data binding infrastructure to apply user-supplied property paths onto a target object are susceptible to a Denial of Service DoS attack. A remote attacker could exploit this by providing specially crafted input, leading to...
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...
Denial-of-Service (DoS)
Spring Framework is vulnerable to a Denial-of-Service DoS. The vulnerability is due to insufficient validation of user-supplied property paths during data binding, which allows an attacker to submit specially crafted property paths that consume excessive resources and potentially cause the...
BIT-JENKINS-2026-84654
In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...
BIT-JENKINS-2026-84647
In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...
PT-2026-88171
In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...
PT-2026-88164
In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...
CVE-2026-84647
A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...
CVE-2026-84664
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...