207 matches found
Imperva Protects from New Spring Framework Zero-Day Vulnerabilities
New zero-day Remote Code Execution RCE vulnerabilities were discovered in Spring Framework, an application development framework and inversion of control container for the Java platform. The vulnerability potentially leaves millions of applications at risk of compromise. In two separate...
Spring Framework RCE via Data Binding on JDK 9+
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...
Spring Framework insecurely handles PropertyDescriptor objects with data binding
Overview The Spring Framework insecurely handles PropertyDescriptor objects, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Spring Framework is a Java framework that can be used to create applications such as web applications...
Spring Framework 代码注入漏洞
Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A code injection vulnerability exists in Spring Framework that stems from the RCE for data binding on JDK 9+.The following products...
Deeply nested json in jackson-databind
jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects...
[SECURITY] Fedora 34 Update: tang-11-1.fc34
Tang is a small daemon for binding data to the presence of a third party...
[SECURITY] Fedora 32 Update: jackson-databind-2.10.5.1-1.fc32
The general-purpose data-binding functionality and tree-model for Jackson D ata Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration...
Unspecified vulnerability in FasterXML jackson-databind (CNVD-2021-03342)
FasterXML jackson-databind is a generic data binding package for Jackson 2.x. FasterXML jackson-databind exists with the FasterXML jackson-databind suffers from a security vulnerability, no detailed vulnerability details are provided at this time...
Unspecified vulnerability in FasterXML jackson-databind (CNVD-2021-03346)
FasterXML jackson-databind is a generic data binding package for Jackson 2.x. A security vulnerability exists in FasterXML jackson-databind. No details of the vulnerability are provided at this time...
FasterXML jackson-databind 代码问题漏洞
FasterXML jackson-databind is a generic data binding package for Jackson 2.x. A security vulnerability exists in FasterXML jackson-databind. No details of the vulnerability are provided at this time...
FasterXML jackson-databind 代码问题漏洞
FasterXML jackson-databind is a generic data binding package for Jackson 2.x. FasterXML jackson-databind has a security vulnerability, and no detailed vulnerability details are provided at this time...
Command execution vulnerability exists in FasterXML jackson-databind (CNVD-2021-00629)
FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind, which can be exploited by an attacker to execute arbitrary commands...
Command execution vulnerability exists in FasterXML jackson-databind (CNVD-2021-00625)
FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind, which can be exploited by an attacker to execute arbitrary commands...
jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig
A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariConfig gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...
FasterXML jackson-databind code issue vulnerability (CNVD-2020-53535)
FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind version 2.x prior to 2.9.10.5. No detailed vulnerability details are provided at...
Fedora Update for jackson-annotations FEDORA-2019-99ff6aa32c
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora Update for jackson-databind FEDORA-2019-cf87377f5f
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora Update for jackson-annotations FEDORA-2019-cf87377f5f
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 31 Update: jackson-databind-2.10.0-1.fc31
The general-purpose data-binding functionality and tree-model for Jackson D ata Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration...