CVE-2020-10673

Vulnerability Description Recently, the Asiainfo Security Network Attack and Defense Laboratory tracked that jackson-databind has updated a JNDI injection blacklist class. If the jar package of this class exists in the project and the JDK version meets the injection version, remote code execution...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091348)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091348 advisory. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70228)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70228 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2022-001272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001272 advisory. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef ak...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091360 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled either globally or for a specific property f...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091415)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091415 advisory. FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorph...

boot-jackson-cve

Reproduction of CVE-2020-36518 in Spring Boot 2.5.10 Execute: root@kitploit: ./mvnw clean verify It will fail with: root@kitploit: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with...

CVE-2017-17485

CVE-2017-17485 CVE-2017-17485:Jackson-databind RCE...

CVE-2019-12086-jackson-databind-file-read

jackson-CVE-2019-12086 Vulnerability Description When Default Typing is enabled, and the classpath contains mysql-connector-java version 8.0.15 released on 2019.2.1 or earlier, an attacker can read arbitrary files by sending malicious JSON data. The mysql-connector-java library is the commonly us...

CVE-2020-36179

Descripción CVE-2020-36179: FasterXML jackson-databind 2.x anterior a 2.9.10.8 maneja incorrectamente la interacción entre gadgets de serialización y tipado, relacionado con oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. CVE-2020-36180: FasterXML jackson-databind 2.x anterior a...

CVE-2020-11113

CVE-2020-11113 CVE-2020-11113:Jackson-databind RCE...

CVE-2020-36188

Descripción FasterXML jackson-databind 2.x antes de 2.9.10.8 maneja incorrectamente la interacción entre gadgets de serialización y tipado, relacionado con com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource Cómo RCE pom.xml root@kitploit: com.fasterxml.jackson.core jackson-databi...

CVE-2020-10673

CVE-2020-10673 CVE-2020-10673:jackson-databind RCE...

CVE-2020-36184

Descripción FasterXML jackson-databind 2.x anterior a 2.9.10.8 maneja incorrectamente la interacción entre gadgets de serialización y tipado, relacionado con org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. Cómo RCE pom.xml root@kitploit: 4.0.0 com.jacksonTest jacksonTest...

CVE-2020-35728

Descripción FasterXML jackson-databind 2.x anterior a 2.9.10.8 maneja incorrectamente la interacción entre gadgets de serialización y tipado, relacionado con com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool también conocido como Xalan embebido en...

CLEANSTART-2026-BM99045 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Java Insecure Deserialization Lab Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE. The project must be run on Java 8u45 Based on Maven with the following dependencies: jackson-databind 2.2.2 commons-collections 3.1 spring-context-support 4.3.11 Mor...

CVE-2020-14195

SimpleTest This is a simple test for FasterXML jackson-databind...

CLEANSTART-2026-DV60497 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Multiple security vulnerabilities affect the wso2is package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

Struts2の脆弱性S2-054, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 要点だけまとめ、読みやすくしたサマリ記事を公開しました。まず概要を知りたい方、あるいはお時間に余裕の無い方におすすめです。 SSTtechlog 08 S2-054, S2-055 および jackson-databindの脆弱性 CVE-2017-7525, CVE-2017-15095 について | SST 株式会社セキュアスカイ・テクノロジー...