5361 matches found
PT-2020-21410
Name of the Vulnerable Software and Affected Versions CBOR library versions prior to 4.0 Description The issue concerns the CBOR library's handling of optional tags that enable CBOR objects to contain references to objects within them. In versions earlier than 4.0, resolving those references...
jackson-databind: Serialization gadgets in ibatis-sqlmap
A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in anteros-core
A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in shaded-hikari-config
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jackson-databind: Serialization gadgets in javax.swing.JEditorPane
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality...
Debian DLA-2270-1 : jackson-databind security update
There were several CVEs reported against src:jackson-databind, which are as follows : CVE-2020-14060 FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...
OSV-2020-516 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned short, 2u> const> hb_array_t<OT::IntType<unsigne
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18513 Crash type: Heap-buffer-overflow READ 2 Crash state: hbarrayt const hbarrayt ::copy ZN22hbserializecontextt5copyIN2OT14UnsizedArrayOfINS17IntTypeItLj2EEEEEJRj...
PT-2020-22290
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported, identified as a Stack-use-after-return READ 4 issue. The crash involves the serialization of certain components, including...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9.
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool. These issues were disclosed as part of the IBM Java SDK updates in April 2020. Vulnerability Details CVEID: CVE-2020-2805 DESCRIPTION: An unspecified vulnerability in Java S...
CVE-2020-14062
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigatio...
CVE-2020-14061
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigatio...
CVE-2020-14060
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation The following conditions a...
CVE-2020-14195
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation Th...
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and...
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...
GHSA-MC6H-4QGP-37QH Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...
Remote Code Execution
jackson-databind is vulnerable to remote code execution. It was possible to use the org.jsecurity gadget type as a serialization gadget through polymorphic typing and execute arbitrary code on the system...
CVE-2020-14195
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...
DEBIAN-CVE-2020-14195
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...
