Remote Code Execution

jackson-databind is vulnerable to remote code execution. The application does not block the commons-configuration and commons-configuration2 classes during deserialization, which would allow a remote attacker to leverage the vulnerability to execute arbitrary code...

RCE jackson-databind

h3. Issue Summary https://hello.atlassian.net/wiki/spaces/SECURITY/pages/566213966/CVE-2019-17267+Investigation+jackson-databind+RCE+again h3. Steps to Reproduce search on stash for jackson-databind...

XML External Entities (XXE)

jackson-mapper-asl is vulnerable to XML external entity attacks. This vulnerability is similar to CVE-2016-3720 whereby the external DTD is not disabled, allowing an attacker to retrieve system files, or perform requests on behalf of the server using malicious XML documents...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to gain full control over the system.

The vulnerability of the FasterXML function com.zaxxer.hikari.HikariConfig in the Jackson-Databind JSON parsing library allows for the restoration of unreliable data structures in memory. Exploiting this vulnerability can enable a malicious actor to gain full control over the system...

The vulnerability of the FasterXML function (com.zaxxer.hikari.HikariDataSource) in the Jackson-Databind JSON file parsing library allows a attacker to gain full control over the system.

The vulnerability of the FasterXML function com.zaxxer.hikari.HikariDataSource in the Jackson-Databind JSON parsing library involves memory corruption due to the incorrect structure of data being restored. Exploiting this vulnerability could allow an attacker to gain full control over the system...

The vulnerability of the FasterXM Java library for JSON file grammar analysis, jackson-databind, allows a attacker to execute arbitrary code.

The vulnerability of the FasterXML function net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup in the Jackson-Databind JSON file parsing library involves memory corruption due to an unreliable data structure. Exploiting this vulnerability could allow a malicious actor to execute...

jackson-mapper-asl XML External Entity Vulnerability

jackson-mapper-asl is a data mapping package built on the Jackson JSON processor. An XML external entity vulnerability exists in version 1.9.x of jackson-mapper-asl. No detailed vulnerability details are provided at this time...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis involves memory restoration of an unreliable data structure. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

DEBIAN-CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

Xxe

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

UBUNTU-CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

CVE-2019-10172

CVE-2019-10172 describes an XML External Entity (XXE) vulnerability in org.codehaus.jackson:jackson-mapper-asl:1.9.x (Codehaus Jackson). Connected sources confirm the flaw affecting jackson-mapper-asl libraries and note that CVE-2016-3720 affects related code, in different classes. Public advisor...

CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the commons-dbcp gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...