CVE-2019-12384

CVE-2019-12384 Jackson RCE 및 SSRF 0x01 python -m SimpleHTTPServer python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException Stri...

CLEANSTART-2026-NN88858 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-PS95562 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-RV05349 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-QU95905 Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2...

CLEANSTART-2026-UF85195 Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2...

CLEANSTART-2026-TS69470 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-RO69102 Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2...

CLEANSTART-2026-JD21089 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

CLEANSTART-2026-BN96134 Polymorphic Typing issue was discovered in FasterXML jackson-databind 2

Security vulnerability affects the apache-hive package. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2019-12086-jackson-databind-file-read

jackson-CVE-2019-12086 취약점 설명 Default Typing이 활성화된 상태에서, classpath에 mysql-connector-java 8.0.15 버전2019.2.1 출시 이하가 존재하는 경우, 공격자는 악의적인 JSON 데이터를 전송하여 임의의 파일을 읽을 수 있습니다. mysql-connector-java 라이브러리는 데이터베이스 연결 시 일반적으로 사용되는 MySQL JDBC입니다. CVE 설명은 다음과 같습니다: A Polymorphic Typing issue was discovered in...

CVE-2020-36179

Описание CVE-2020-36179: FasterXML jackson-databind 2.x до версии 2.9.10.8 некорректно обрабатывает взаимодействие между гаджетами сериализации и типизацией, связан с oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. CVE-2020-36180: FasterXML jackson-databind 2.x до версии 2.9.10.8...

CVE-2020-36188

설명 FasterXML jackson-databind 2.x 버전 중 2.9.10.8 미만은 직렬화 가젯과 타이핑 간의 상호작용을 잘못 처리하며, 이는 com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource와 관련됩니다. RCE 방법 pom.xml com.fasterxml.jackson.core jackson-databind 2.9.10.7 com.newrelic.agent.java newrelic-agent 4.9.0 org.slf4j slf4j-nop 1.7...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML Jackson-Databind 2.x versions before 2.9.10.8 mishandle the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML Jackson-Databind 2.x versions before 2.9.10.8 mishandle the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2022-001272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001272 advisory. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef ak...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091360 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled either globally or for a specific property f...