3338 matches found
CVE-2020-8840
CVE-2020-8840：FasterXML/jackson-databind 远程代码执行漏洞 0x00 简介 jackson-databind 是隶属 FasterXML 项目组下的JSON处理库。 0x01 漏洞概述 2月19日，NVD发布安全通告披露了jackson-databind由JNDI注入导致的远程代码执行漏洞（CVE-2020-8840），CVSS评分为9.8...
ROOT-APP-MAVEN-CVE-2026-54512 CVE-2026-54512 in com.fasterxml.jackson.core:jackson-databind - Patched by Root
Root has patched CVE-2026-54512 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-54513 CVE-2026-54513 in com.fasterxml.jackson.core:jackson-databind - Patched by Root
Root has patched CVE-2026-54513 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...
CVE-2019-14439
CVE-2019-14439 Jackson-databind Ejecución Remota de Código...
CVE-2020-9548
CVE-2020-9548：FasterXML/jackson-databind 远程代码执行漏洞...
jackson-CVE-2020-8840
CVE-2020-8840 FasterXML/jackson-databind 远程代码执行漏洞...
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)
Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to jackson-databind. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing t...
CVE-2020-10673
漏洞描述 近日,亚信安全网络攻防实验室跟踪到 jackson-databind 更新了1个jndi注入的黑名单类.如果在项目包中存在该类的jar包且JDK版本满足注入版本,则可以使用JNDI注入的方式导致远程代码执行.该类为 com.caucho.config.types.ResourceRef. 漏洞编号： CVE-2020-10673 Jackson内部编号2660 影响范围 jackson-databind = 2.10.3 fastjson = 1.2.66 修复建议 目前官方已发表修复补丁，可进入...
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...
CLEANSTART-2026-QT94444 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
CVE-2026-77310 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...
CLEANSTART-2026-FF14094 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
CVE-2019-12384
CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException...
jackson-databind-2.18.11-1.1 on GA media (moderate)
jackson-databind-2.18.11-1.1 on GA media Announcement ID: openSUSE-SU-2026:11877-1 Rating: moderate Cross-References: CVE-2026-19032 CVE-2026-68497 CVE-2026-83557 CVE-2026-91776 CVE-2026-91777 CVSS scores: CVE-2026-19032 SUSE : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2026-19032 SUSE ...
Demo-Exploit-Jackson-RCE
Demo-Exploit-Jackson-RCE Basado en el proyecto jackson-rce-via-spel, este proyecto sirve como una aplicación web de ejemplo para probar múltiples vectores de ataque carga de archivos, formularios contra la vulnerabilidad de Jackson-databind. Introducción Basado en un frontend Angular7 y un backen...
CVE-2020-9547
CVE-2020-9547：FasterXML/jackson-databind 远程代码执行漏洞...
GHSA-GX83-3VF8-GH7J jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
Summary DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" Object, Serializable, Closeable, AutoCloseable,...
EUVD-2026-69250
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types incomplete PolymorphicTypeValidator denylist...
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
Summary DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" Object, Serializable, Closeable, AutoCloseable,...
GHSA-Q4XH-88C3-WMH7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Summary jackson-databind 3.2.1 deserializes a JSON string bound to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue / newXMLGregorianCalendarvalue. Per the XML-Schema lexical grammar these factory...