CVE-2018-14718

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization...

CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

CVE-2018-19361

CVE-2018-19361 is listed in the IBM Cloudera Observability bulletin as affecting Cloudera Observability on Premises 3.5.3, with remediation in 3.6.2. Description from the bulletin notes that FasterXML jackson-databind 2.x before 2.9.8 allows polymorphic deserialization via the openjpa class, yiel...

CVE-2018-19360

CVE-2018-19360 affects FasterXML jackson-databind 2.x before 2.9.8, where failure to block the axis2-transport-jms class enables polymorphic deserialization with unspecified impact. IBM/Cloudera docs corroborate related deserialization flaws across jackson-databind versions and list remediation a...

CVE-2018-19362

CVE-2018-19362: A vulnerability in Jackson Databind (FasterXML) affects 2.x prior to 2.9.8, due to failure to block the jboss-common-core class in polymorphic deserialization. The IBM doc lists an unknown impact/attack vector with a base score of 5.3 and notes the issue as an unspecified deserial...

PT-2019-2924

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.8 Description The issue is related to the inability to block the axis2-transport-jms class from polymorphic deserialization in the FasterXML Java library for parsing JSON files,...

FasterXML Jackson-databind Deserialization Multiple Remote Code Execution Vulnerabilities

Description FasterXML Jackson-databind is prone to multiple remote-code execution vulnerabilities. Successfully exploiting these issues allow attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Jackson-databi...

CVE-2018-19360: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization...

CVE-2018-19362: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization...

CVE-2018-14719: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

CVE-2018-14718: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization...

CVE-2018-19361: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization...

CVE-2018-14720: Deserialization of Untrusted Data

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity XXE attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization...

CVE-2018-14721: Server-Side Request Forgery (SSRF)

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...

PT-2019-2925

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.8 Description The issue is related to the failure to block the openjpa class from polymorphic deserialization in the FasterXML jackson-databind library, which can be used for parsing JSON file...

PT-2019-2926

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.8 Description The issue is related to the FasterXML Java library for parsing JSON files, jackson-databind, and its failure to block the jboss-common-core class from polymorphic deserialization...

PT-2019-1735

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.7 FasterXML jackson-databind version 2.8.11.3 and earlier FasterXML jackson-databind version 2.7.9.5 and earlier FasterXML jackson-databind version 2.6.7.3 and earlier Description The issue is...

PT-2019-3698

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, 19c Description The issue is related to the Core RDBMS jackson-databind component of Oracle Database Server, where an easily exploitable vulnerability allows a low-privileged attacker wi...

Deserialization Of Untrusted Data

jackson-databind can deserialize untrusted data. The vulnerability is due to an incomplete fix for the CVE-2017-7525...

Deserialization Of Untrusted Data

jackson-databind is susceptible to deserialization of untrusted data. It is due to an incomplete fix for the CVE-2017-7525 which has classes which perform general-purpose data-binding functionality and tree-model for untrusted data...