5862 matches found
com.zerotoheroes:hs-draft-odds (>=1.0.0, <=1.0.2), com.zerotoheroes:hs-game-converter (>=1.0.0, <=1.0.12) +32 more potentially affected by CVE-2016-8749 via org.apache.camel:camel-jackson (>=2.17.0, <=2.17.4)
org.apache.camel:camel-jackson MAVEN version =2.17.0, =1.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.7, =1.1.0-m1, =2.2.105, =2.2.105, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.7 and more Source cves: CVE-2016-8749 Source advisory: GHSA-VVJC-Q5VR-52Q6...
ca.islandora.alpaca:islandora-indexing-triplestore (>=0.2.0, <=0.7.1), cool.pandora:acrepo-exts-image (0.0.3) +279 more potentially affected by CVE-2016-8749 via org.apache.camel:camel-jackson (>=2.18.0, <=2.18.1)
org.apache.camel:camel-jackson MAVEN version =2.18.0, =0.2.0, =1.0.8, =1.0.8, =1.0.10, =1.1.0, =1.0.8, =1.0.8, =1.1.0, =1.0.8, =1.0.8, =1.0.8, =0.0.7, =0.0.7, =0.0.10 and more Source cves: CVE-2016-8749 Source advisory: OSV:GHSA-VVJC-Q5VR-52Q6...
ca.islandora.alpaca:islandora-indexing-triplestore (>=0.2.0, <=0.7.1), cool.pandora:acrepo-exts-image (0.0.3) +279 more potentially affected by CVE-2016-8749 via org.apache.camel:camel-jackson (>=2.18.0, <=2.18.1)
org.apache.camel:camel-jackson MAVEN version =2.18.0, =0.2.0, =1.0.8, =1.0.8, =1.0.10, =1.1.0, =1.0.8, =1.0.8, =1.1.0, =1.0.8, =1.0.8, =1.0.8, =0.0.7, =0.0.7, =0.0.10 and more Source cves: CVE-2016-8749 Source advisory: GHSA-VVJC-Q5VR-52Q6...
GHSA-VVJC-Q5VR-52Q6 Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks
Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various...
Apache Struts REST Plugin can potentially allow a DoS attack
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here...
GHSA-38CR-2PH5-FRR9 Apache Struts REST Plugin can potentially allow a DoS attack
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here...
FasterXML jackson-databind allows unauthenticated remote code execution
FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input...
GHSA-CGGJ-FVV3-CQWV FasterXML jackson-databind allows unauthenticated remote code execution
FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input...
ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ai.databand:dbnd-agent (>=0.42.1, <=0.80.6) +5567 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.7.0, <=2.7.9.2)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.7.0, =0.3.0, =0.42.1, =0.42.1, =0.40.2, =0.42.1, =0.2, =0.8.0, =3.3.3, =0.0.1, =0.0.2, =0.0.3 - at.ac.ait.lablink.clients:sync 0.0.1 - at.ac.ait.lablink:core 0.0.1 and more Source cves: CVE-2018-7489 Source advisory: GHSA-CGGJ-FVV3-CQWV...
ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +23038 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.0.0-rc1, <=2.6.7.4)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.0.0-rc1, =0.1, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =local, =13publish-0.0.12 and more Source cves:...
aero.champ:cargojson (1.0), ai.genauth:genauth-java-sdk (3.1.11) +6967 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.4)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...
ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ai.databand:dbnd-agent (>=0.42.1, <=0.80.6) +5567 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.7.0, <=2.7.9.2)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.7.0, =0.3.0, =0.42.1, =0.42.1, =0.40.2, =0.42.1, =0.2, =0.8.0, =3.3.3, =0.0.1, =0.0.2, =0.0.3 - at.ac.ait.lablink.clients:sync 0.0.1 - at.ac.ait.lablink:core 0.0.1 and more Source cves: CVE-2018-7489 Source advisory:...
aero.champ:cargojson (1.0), ai.genauth:genauth-java-sdk (3.1.11) +6967 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.4)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...
ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +23038 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.0.0-rc1, <=2.6.7.4)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.0.0-rc1, =0.1, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =local, =13publish-0.0.12 and more Source cves:...
ai.grakn:grakn (>=0.17.0, <=0.18.0), ai.grakn:grakn-client (>=0.17.0, <=0.18.0) +13448 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.18.0 and more Source cves: CVE-2018-7489 Source advisory: GHSA-CGGJ-FVV3-CQWV...
ai.grakn:grakn (>=0.17.0, <=0.18.0), ai.grakn:grakn-client (>=0.17.0, <=0.18.0) +13448 more potentially affected by CVE-2018-7489 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.18.0 and more Source cves: CVE-2018-7489 Source advisory: OSV:GHSA-CGGJ-FVV3-CQWV...
Important: Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update
An update is now available for Red Hat Satellite 6.4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes...
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...
ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +20684 more potentially affected by CVE-2017-7525 via com.fasterxml.jackson.core:jackson-databind (>=2.0.0-rc1, <=2.6.7)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.0.0-rc1, =0.1, =1.4.2, =0.1.6, =0.1.4-sb1x, =0.7.0, =0.12.0, =0.12.0, =0.6.1, =0.6.1, =0.15.0 and more Source cves: CVE-2017-7525 Source advisory: GHSA-QXXX-2PP7-5HMX...