CVE-2020-14195

SimpleTest 这是为 FasterXML jackson-databind 进行的简单测试。...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-68497 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-68497

CVE-2026-68497 is a CPU denial-of-service in jackson-databind caused by unbounded numeric parsing in the Duration and XMLGregorianCalendar deserializers. The XML datatype deserializer passes raw JSON strings to DatatypeFactory without the number-length pre-check used by other deserializers, and t...

EUVD-2026-76142

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

boot-jackson-cve

复现 Spring Boot 2.5.10 中的 CVE-2020-36518 执行： root@kitploit: ./mvnw clean verify 它会失败并显示： root@kitploit: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a...

CVE-2019-14439

CVE-2019-14439 Jackson-databind RCE...

Demo-Exploit-Jackson-RCE

Demo-Exploit-Jackson-RCE 基于项目 jackson-rce-via-spel，本项目作为一个示例Web应用程序，用于测试针对Jackson-databind漏洞的多种攻击向量（文件上传、表单）。 介绍 基于Angular7前端和spring-boot后端，可以测试不同的攻击向量，并对结果进行可视化和检查。 构建 构建并打包spring boot和angular7成一个可部署的war文件。 mvn package 运行 运行后会自动在浏览器中打开 http://localhost:4200。 backend/mvn spring-boot:run 截图...

FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...

FasterXML jackson-databind - Deserialization Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...

jackson-CVE-2020-8840

CVE-2020-8840 FasterXML/jackson-databind 远程代码执行漏洞...

CVE-2020-8840

CVE-2020-8840 Jackson-databind远程代码执行漏洞（CVE-2020-8840）分析复现环境代码。 项目包含： jackson-databind、Fastjson中payload WebServer恶意类 编译好的marshalsec-0.0.3-SNAPSHOT-all.jar 漏洞简介 Jackson-databind远程代码执行漏洞（CVE-2020-8840），攻击者可利用xbean-reflect的利用链（org.apache.xbean.propertyeditor.JndiConverter）触发JNDI远程类加载从而达到远程代码执行。...

CVE-2019-12384

CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer root@kitploit: python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd...

study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

Struts2の脆弱性S2-054, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 要点だけまとめ、読みやすくしたサマリ記事を公開しました。まず概要を知りたい方、あるいはお時間に余裕の無い方におすすめです。 SSTtechlog 08 S2-054, S2-055 および jackson-databindの脆弱性 CVE-2017-7525, CVE-2017-15095 について | SST 株式会社セキュアスカイ・テクノロジー...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

CVE-2020-9547

CVE-2020-9547：Vulnerabilidad de ejecución remota de código en FasterXML/jackson-databind...

CVE-2020-9548

CVE-2020-9548: Vulnerabilidad de ejecución remota de código en FasterXML/jackson-databind...

CVE-2020-8840

CVE-2020-8840：FasterXML/jackson-databind リモートコード実行脆弱性 0x00 はじめに jackson-databind は、FasterXML プロジェクトグループに属するJSON処理ライブラリです。 0x01 脆弱性概要 2月19日、NVDはセキュリティ勧告を公開し、jackson-databind におけるJNDIインジェクションに起因するリモートコード実行脆弱性（CVE-2020-8840）を開示しました。CVSSスコアは9.8です。影響を受けるバージョンの jackson-databind では、一部の xbean-reflect/JND...