jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

Important: Red Hat Security Advisory: rh-maven35-jackson-databind security update

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Debian DLA-2406-1 : jackson-databind security update

It was discovered that there was an external entity expansion vulnerability in jackson-databind, a Java library for processing JSON. For Debian 9 'Stretch', this problem has been fixed in version 2.8.6-1+deb9u8. We recommend that you upgrade your jackson-databind packages. For the detailed securi...

Debian: Security Advisory (DLA-2406-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Netcool Operations Insight component IBM Network Performance Insight 1.3.1 affected by CVE-2020-14195

Summary Netcool Operations Insight component IBM Network Performance Insight 1.3.1 affected by CVE-2020-14195 Vulnerability Details CVEID: CVE-2020-14195 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe...

Security Bulletin: Netcool Operations Insight component IBM Network Performance Insight 1.3.1 affected by CVE-2020-14062

Summary Netcool Operations Insight component IBM Network Performance Insight 1.3.1 affected by CVE-2020-14062 Vulnerability Details CVEID: CVE-2020-14062 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe...

[SECURITY] [DLA 2406-1] jackson-databind security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2406-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 14, 2020 https://wiki.debian.org/LTS -...

The vulnerability of the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool component in the Jackson-databind library of the FasterXML project allows a hacker to execute arbitrary code.

The vulnerability of the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool component in the Jackson-databind library of the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the weblogic/oracle-aqjms component of the Jackson-databind library in the FasterXML project allows a attacker to execute arbitrary code.

The vulnerability of the weblogic/oracle-aqjms component of the Jackson-databind library in the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool component in the Jackson-databind library of the FasterXML project allows a attacker to execute arbitrary code.

The vulnerability of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool component in the Jackson-databind library of the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary co...

DLA-2406-1 jackson-databind - security update

Bulletin has no description...

CVE-2020-25649

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity. Mitigation There is currently no known mitigation for this flaw...

Security Bulletin: IBM Security Guardium is affected by a jackson-databind vulnerability

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2020-9547 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by the mishandling of interaction between serialization gadgets and typing in...

FreeBSD : Payara -- A Polymorphic Typing issue in FasterXML jackson-databind (bd159669-0808-11eb-a3a4-0019dbb15b3f)

Payara Releases reports : The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases : - CVE-2019-12086 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before...

Security Bulletin: IBM Security Guardium is affected by a jackson-databind vulnerability

Summary IBM Security Guardium has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-14439 DESCRIPTION: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled either globally or for a specific...

Security Bulletin: Vulnerability identified in jackson-databind shipped with IBM Cloud Pak System (CVE-2020-24750)

Summary Vulnerability identified in jackson-databind shipped with IBM Cloud Pak System. IBM Clous Pak System addresssed vulnerabilities. Vulnerability Details CVEID: CVE-2020-24750 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, cause...

jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.6. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and system availability...

Important: Red Hat Security Advisory: rh-maven35-jackson-databind security update

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

The vulnerability of the Jackson-databind library in the FasterXML project, related to the restoration of unreliable data structures in memory, allows attackers to execute arbitrary code.

The vulnerability of the Jackson-databind library in the FasterXML project is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...