jackson-databind: improper polymorphic deserialization in axis2-transport-jms class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the axis2-transport-jms class. An attacker could use this flaw to execute arbitrary code...

The vulnerability of the Jackson-databind library, related to its inability to lock the logback-core class from polymorphic deserialization, allows a hacker to execute arbitrary code.

The vulnerability of the Jackson-databind library is related to its inability to prevent the logback-core class from being polymorphic deserialized. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows a hacker to read arbitrary files on the server.

The vulnerability of the Jackson-databind library is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files on the server using a specially created JSON message...

The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows attackers to read arbitrary files on the server.

The vulnerability of the Jackson-databind library is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files on the server by sending a specially crafted JSON message...

Remote Code Execution

jackson-databind is vulnerable to remote code execution. The application does not block the xalan classes during deserialization, which would allow a remote attacker to leverage the vulnerability to execute arbitrary code...

Remote Code Execution

jackson-databind is vulnerable to remote code execution. The application does not block the commons-configuration and commons-configuration2 classes during deserialization, which would allow a remote attacker to leverage the vulnerability to execute arbitrary code...

RCE jackson-databind

h3. Issue Summary https://hello.atlassian.net/wiki/spaces/SECURITY/pages/566213966/CVE-2019-17267+Investigation+jackson-databind+RCE+again h3. Steps to Reproduce search on stash for jackson-databind...

The vulnerability of the FasterXML function (com.zaxxer.hikari.HikariDataSource) in the Jackson-Databind JSON file parsing library allows a attacker to gain full control over the system.

The vulnerability of the FasterXML function com.zaxxer.hikari.HikariDataSource in the Jackson-Databind JSON parsing library involves memory corruption due to the incorrect structure of data being restored. Exploiting this vulnerability could allow an attacker to gain full control over the system...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to gain full control over the system.

The vulnerability of the FasterXML function com.zaxxer.hikari.HikariConfig in the Jackson-Databind JSON parsing library allows for the restoration of unreliable data structures in memory. Exploiting this vulnerability can enable a malicious actor to gain full control over the system...

The vulnerability of the FasterXM Java library for JSON file grammar analysis, jackson-databind, allows a attacker to execute arbitrary code.

The vulnerability of the FasterXML function net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup in the Jackson-Databind JSON file parsing library involves memory corruption due to an unreliable data structure. Exploiting this vulnerability could allow a malicious actor to execute...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis involves memory restoration of an unreliable data structure. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

jackson-databind: Serialization gadgets in classes of the ehcache package

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLA...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the p6spy gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the commons-dbcp gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

FasterXML jackson-databind input validation error vulnerability (CNVD-2019-41721)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . An input validation error vulnerability exists in FasterXML jackson-databind. An attacker could exploit this vulnerability to execute malicious...

FasterXML jackson-databind input validation error vulnerability (CNVD-2019-41720)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . An input validation error vulnerability exists in FasterXML jackson-databind. An attack could exploit this vulnerability to execute malicious...

The vulnerability of the SubTypeValidator.java file in the Jackson-databind library allows a hacker to execute arbitrary code.

The vulnerability of the SubTypeValidator.java file in the Jackson-databind library is related to incorrect default input handling. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...