CVE-2022-29631: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequestset and jodd.http.HttpRequestsend. These vulnerabilities allow attackers to execute Server-Side Request Forgery SSRF via a crafted TCP payload...

Deserialization of Untrusted Data in Jodd

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

GHSA-JRG3-QQ99-35G7 Deserialization of Untrusted Data in Jodd

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

Deserialization Of Untrusted Object

jodd-json is vulnerable to deserialization of untrusted object. The vulnerability exists when the setClassMetadataName method was introduced, which fails to properly restrict certain types of classes during deserialization...

CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

Deserialization of untrusted data

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

UBUNTU-CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-21234

Jodd before 5.0.4 is affected by CVE-2018-21234: Deserialization of Untrusted JSON Data when setClassMetadataName is set. The issue stems from how the library handles deserialization, enabling potentially untrusted data to be deserialized. Impact is indicated as high (NVD CVSS v3.1 base score 9.8...

CVE-2018-21234

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-21234

Removed by vendor...

PT-2020-8878

Name of the Vulnerable Software and Affected Versions Jodd versions prior to 5.0.4 Description The issue concerns the deserialization of untrusted JSON data when the setClassMetadataName is set. This allows for potential exploitation. Recommendations For versions prior to 5.0.4, update to version...

CVE-2018-21234: Deserialization of Untrusted Data

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...

CVE-2018-12022

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...