CVE-2020-25649

The CVE-2020-25649 entry concerns a flaw in FasterXML Jackson Databind where entity expansion was not properly secured, enabling XML External Entity (XXE) attacks. This is a data-integrity risk. Connected advisories consistently associate the issue with Jackson Databind and XXE, and several sourc...

CVE-2017-5645

CVE-2017-5645 affects Apache Log4j 2.x prior to 2.8.2. The vulnerability arises when using a TCP/UDP socket server to receive serialized log events from another application; a crafted binary payload can be deserialized to execute arbitrary code. The documented impact is remote code execution via ...

CVE-2019-14540

CVE-2019-14540 affects jackson-databind up to version 2.9.10 with serialization gadget risk involving the HikariCP classes (com.zaxxer.hikari.HikariConfig). The authoritative initial doc notes a polymorphic typing issue in jackson-databind related to HikariConfig. Connected-material references (A...

CVE-2020-8840

CVE-2020-8840 affects FasterXML jackson-databind 2.0.0–2.9.10.2, where missing blocking of xbean-reflect/JNDI chains (notably org.apache.xbean.propertyeditor.JndiConverter) enables JNDI injection leading to remote code execution. Affected component is jackson-databind’s deserialization path; impa...

CVE-2021-21409

The CVE concerns Netty’s HTTP/2 codec (io.netty:netty-codec-http2) where, before version 4.1.61.Final, a Content-Length check can be bypassed when a single Http2HeaderFrame with endStream set to true is used. This enables HTTP request smuggling if the request is proxied and translated to HTTP/1.1...

CVE-2020-10683

CVE-2020-10683 is described in IBM Bulletin sources as an XXE vulnerability in the dom4j library, allowing a remote authenticated attacker to obtain sensitive information through XML processing. The issue stems from dom4j handling External DTDs/Entities by default, and multiple IBM entries map th...

CVE-2021-21295

Netty CVE-2021-21295 affects io.netty:netty-codec-http2 prior to 4.1.60.Final, where Content-Length validation can be bypassed when HTTP/2 is downgraded to HTTP/1.1 in proxied scenarios, enabling HTTP request smuggling. The issue occurs when HTTP2MultiplexCodec/Http2FrameCodec are used and Http2S...

CVE-2019-20330

CVE-2019-20330 affects FasterXML jackson-databind 2.x before 2.9.10.2, which lacks blocking for net.sf.ehcache in deserialization. This is a deserialization-side issue with high–critical impact potential; remediation is to upgrade to jackson-databind 2.9.10.2 or newer as indicated by connected IB...

CVE-2019-14893

CVE-2019-14893 affects FasterXML jackson-databind up to versions before 2.9.10 and 2.10.0, enabling unsafe polymorphic deserialization via enableDefaultTyping or JsonTypeInfo Id.CLASS/Id.MINIMAL_CLASS, potentially leading to remote code execution when deserializing from unsafe sources. Root cause...

CVE-2019-17267

Summary (CVE-2019-17267): A polymorphic typing deserialization issue in FasterXML Jackson Databind (versions prior to 2.9.10) related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. IBM/X-Force details show a base score of 7.3 (CVSSv3) with high impact on confidentiality, integrit...

CVE-2019-16943

CVE-2019-16943 affects FasterXML jackson-databind (versions 2.0.0–2.9.10) via a polymorphic typing flaw that, when Default Typing is enabled for an exposed JSON endpoint and a p6spy P6DataSource is present in the classpath with an accessible RMI endpoint, can lead to remote code execution. The ro...

CVE-2019-16942

CVE-2019-16942 affects FasterXML jackson-databind 2.0.0–2.9.10. When Default Typing is enabled for an externally exposed JSON endpoint and the service includes the commons-dbcp 1.4 jar on the classpath, with an accessible RMI endpoint, the vulnerability can allow execution of a malicious payload ...

CVE-2020-11612

Netty CVE-2020-11612 affects Netty 4.1.x before 4.1.46, where ZlibDecoders may allocate memory without bounds while decoding a ZlibEncoded stream, potentially exhausting server memory. Affected product: Netty 4.1.x (ZlibDecoders). Remediation: upgrade to Netty 4.1.46.Final or later. The documents...

CVE-2019-16335

CVE-2019-16335 is a vulnerability in FasterXML jackson-databind (pre-2.9.10) related to polymorphic typing in the HikariDataSource path. Connected sources confirm the affected component is jackson-databind and specifically the serialization gadgets involving com.zaxxer.hikari.HikariDataSource. Im...

CVE-2021-20190

CVE-2021-20190 is a Jackson Databind deserialization vulnerability involving the interaction between serialization gadgets and typing, present in Jackson Databind up to 2.9.10.7. The IBM bulletin for Cloudera Observability confirms this CVE as part of a collection and notes a fix in Cloudera Obse...

CVE-2019-17359

The CVE-2019-17359 entry concerns Bouncy Castle Crypto (BC Java) 1.63. The vulnerability lies in the ASN.1 parser, which can trigger a large memory allocation leading to a memory exhaustion/OutOfMemoryError via crafted ASN.1 data. Affected product: BC Java 1.63; fixed in BC Java 1.64. The issue i...

CVE-2018-14550

CVE-2018-14550 corresponds to a stack-based buffer overflow in libpng 1.6.35’s PNM decoding path, specifically in get_token() within pnm2png.c of pnm2png. The issue is triggered during third-party PNM decoding and is documented across multiple advisories (EulerOS, Gentoo GLSA, GN/NET, etc.). The ...

CVE-2017-15518

CVE-2017-15518 affects NetApp OnCommand API Services (versions prior to 2.1) and NetApp Service Level Manager (prior to 1.0RC4). Root cause is that a privileged database user password is logged during operation; the vulnerability is mitigated by upgrading to the fixed versions. Documents indicate...

CVE-2017-8919

CVE-2017-8919 affects NetApp OnCommand API Services (versions before 1.2P3). The vulnerability occurs because LDAP BIND passwords are logged when a user authenticates via the REST API, allowing remote authenticated users to obtain sensitive password information via unspecified vectors. Impact is ...