ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.grakn:grakn (>=0.17.0, <=0.18.0) +14285 more potentially affected by CVE-2018-14721 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.2)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.18.0 and more Source cves: CVE-2018-14721 Source advisory: MEND:CVE-2018-14721...

CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...

CVE-2018-14718

CVE-2018-14718 affects FasterXML jackson-databind 2.x (pre-2.9.7). Description: remote code execution via deserialization due to failure to block the slf4j-ext class from polymorphic deserialization. IBM watsonx.data is listed as affected (versions 1.0.0–2.0.0 in some bulletins; later bulletins s...

aero.champ:cargojson (1.0), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.7) +17609 more potentially affected by CVE-2018-19362 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.7)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =0.1.2, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

CVE-2018-19362

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization...

CVE-2018-19362

CVE-2018-19362: A vulnerability in Jackson Databind (FasterXML) affects 2.x prior to 2.9.8, due to failure to block the jboss-common-core class in polymorphic deserialization. The IBM doc lists an unknown impact/attack vector with a base score of 5.3 and notes the issue as an unspecified deserial...

CVE-2018-14718

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization...

CVE-2018-19360

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization...

aero.champ:cargojson (1.0), ai.genauth:genauth-java-sdk (3.1.11) +14747 more potentially affected by CVE-2018-14721 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.6)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

aero.champ:cargojson (1.0), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.7) +17609 more potentially affected by CVE-2018-19360 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.7)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =0.1.2, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

CVE-2018-14719

CVE-2018-14719 involves FasterXML Jackson Databind 2.x up to but before 2.9.7. The root cause is failure to block polymorphic deserialization of certain gadgets (blaze-ds-opt/blaze-ds-core), enabling remote code execution if the gadget classes can be reached. The IBM bulletin references Jackson D...

CVE-2018-19361

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.grakn:grakn (>=0.17.0, <=0.18.0) +14285 more potentially affected by CVE-2018-19362 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.2)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.18.0 and more Source cves: CVE-2018-19362 Source advisory: MEND:CVE-2018-19362...

CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...

CVE-2018-19361

CVE-2018-19361 is listed in the IBM Cloudera Observability bulletin as affecting Cloudera Observability on Premises 3.5.3, with remediation in 3.6.2. Description from the bulletin notes that FasterXML jackson-databind 2.x before 2.9.8 allows polymorphic deserialization via the openjpa class, yiel...

CVE-2018-19360

CVE-2018-19360 affects FasterXML jackson-databind 2.x before 2.9.8, where failure to block the axis2-transport-jms class enables polymorphic deserialization with unspecified impact. IBM/Cloudera docs corroborate related deserialization flaws across jackson-databind versions and list remediation a...

CVE-2018-19361

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization...

CVE-2018-14721

CVE-2018-14721 affects FasterXML jackson-databind 2.x up to 2.9.6 (before 2.9.7). The flaw allows remote attackers to perform SSRF by failing to block axis2-jaxws class during polymorphic deserialization, enabling server-side requests under network access. The vulnerability is tied to the misuse ...

CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...