CVE-2025-59340

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...

GHSA-M49C-G9WR-HV6V jinjava has Sandbox Bypass via JavaType-Based Deserialization

Summary jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as getClass, and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying...

jinjava has Sandbox Bypass via JavaType-Based Deserialization

Summary jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as getClass, and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying...

PT-2025-38270

Name of the Vulnerable Software and Affected Versions jinjava versions prior to 2.8.1 Description jinjava is a Java-based template engine. A sandbox escape flaw exists due to unrestricted interaction with the properties of JinjavaInterpreter instances, specifically through the ObjectMapper. By...

org.hectorclient:hector-object-mapper (3.1-08), org.hectorclient:hector-test (1.1-3) potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (1.1.10)

org.apache.cassandra:cassandra-all MAVEN version 1.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - org.hectorclient:hector-object-mapper 3.1-08 - org.hectorclient:hector-test 1.1-3 Source...

com.aerospike:aerospike-connect-inbound-sdk (1.2.1), com.aerospike:aerospike-document-api (>=1.2.0, <=2.0.0) +21 more potentially affected by CVE-2023-36480 via com.aerospike:aerospike-client (>=6.0.0, <=6.1.11)

com.aerospike:aerospike-client MAVEN version =6.0.0, =1.2.0, =1.6.0, =6.1.0, =2.1.0, =0.8.0, =0.8.0, =0.8.0, =3.5.0, =0.8.0, =1.1, =2.2.0, =3.0.0-rc8 - io.github.reugn:aerospike-client-kotlin 0.4.0 and more Source cves: CVE-2023-36480 Source advisory: MEND:CVE-2023-36480...

SUSE CVE-2017-7525

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

SUSE CVE-2017-15095

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw...

com.carmanconsulting.cassidy:cassidy (>=1.0, <=2.0), com.carmanconsulting.cassidy:cassidy-joda (2.0) +7 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (2.0.4)

org.apache.cassandra:cassandra-all MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.carmanconsulting.cassidy:cassidy =1.0, =0.73, =2.11.1, =2.11.1, =2.11.1, =2.15 -...

com.netflix.astyanax:astyanax (>=1.0.4, <=1.0.6), com.savoirtech.hecate:hecate-core (1.0.16) +4 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (1.1.0)

org.apache.cassandra:cassandra-all MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.netflix.astyanax:astyanax =1.0.4, =1.1-0, =3.1-05, =1.1-0, =1.1-2 Source cves:...

me.prettyprint:hector-core (>=0.7.0-29, <=0.7.0-31), me.prettyprint:hector-object-mapper (>=1.0-07, <=1.0-09) +2 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (0.7.4)

org.apache.cassandra:cassandra-all MAVEN version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - me.prettyprint:hector-core =0.7.0-29, =1.0-07, =1.0-09 -...

org.hectorclient:hector-object-mapper (3.1-08), org.hectorclient:hector-test (1.1-3) potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (1.1.10)

org.apache.cassandra:cassandra-all MAVEN version 1.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - org.hectorclient:hector-object-mapper 3.1-08 - org.hectorclient:hector-test 1.1-3 Source...

PT-2021-12003 · Vaadin · Com.Vaadin:Flow-Server +1

Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin versions 15.0.0 through 15.0.4 Description: The issue is related to an insecure configuration of the default ObjectMapper in the affected software. This may expose sensitive data if t...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

GHSA-QXXX-2PP7-5HMX jackson-databind is vulnerable to a deserialization flaw

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisti...

FasterXML jackson-databind ObjectMapper Code Execution

The vulnerability of the ObjectMapper component in the FasterXML jackson-databind library relates to the restoration of unreliable data structures in memory. Exploiting this vulnerability allows a malicious actor to bypass the “black list” restrictions and execute arbitrary code using specially...

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisti...

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisti...