Debian DLA-2990-1 : jackson-databind - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2990 advisory. - jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. CVE-2020-36518 Note that Nessus has not...

CVE-2020-36518

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...

Denial Of Service (DoS)

com.fasterxml.jackson.core:jackson-databind is vulnerable to Denial Of Service DoS. A malicious user is able to cause a StackOverflow exception using a large depth of nested objects resulting in a denial of service conditions...

GHSA-57J2-W4CX-62H2 Deeply nested json in jackson-databind

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects...

Deeply nested json in jackson-databind

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects...

CVE-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

DEBIAN-CVE-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

CVE-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

CVE-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

FasterXML jackson-databind buffer error vulnerability

FasterXML jackson-databind is a JAVA-based data formats such as XML and JSON and JAVA objects can be converted to the library . Jackson can easily convert Java objects into json objects and xml documents , the same can also be json, xml into Java objects . FasterXML jackson-databind 2.13.0 before...

CVE-2020-36518: Out-of-bounds Write

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

CVE-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

Prototype Pollution in bonnevoyager/nested-objects-util

Description nested-objects-util is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var unflatten = require"nested-objects-util" console.log"Before : " + .polluted; unflatten"proto.polluted": "Yes! Its Polluted" console.log"After : " + .polluted; 2...

Node.js third-party modules: [nested-property] Prototype Pollution

Hi team, I would like to report a prototype pollution vulnerability in nested-property that allows an attacker to modify properties on Object.prototype. Module name:nested-property version: 1.0.4 npm page: https://www.npmjs.com/package/nested-property Module Description Read, write or test a data...

cc.kebei:onion-easy-orm (3.0.0), cc.kebei:onion-easy-orm-core (3.0.0) +1972 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.30)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0.0, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.2.09 and more Source cves: CVE-2017-18349 Source advisory: OSV:GHSA-XJRR-XV9M-4PW5...

UBUNTU-CVE-2014-10064

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example...

CVE-2014-10064

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example...

CVE-2014-10064

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example...

Adobe Flash Player Use After Free Remote Code Execution (APSB15-05: CVE-2015-0341)

A Use-after-free vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an error while handling nested objects in the swf file. A remote attacker could exploit this vulnerability by enticing a target user to open a specially crafted swf file, that can lead to execute...

Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107)

Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which allows remote attackers to bypass intended sandbox restrictions via a crafted web site...