Vulnerabilidades de FasterXML
CVEs publicadas que afetam produtos de FasterXML: 61 registro(s), com severidade, exploração e correções.
Jackson-databind 59Jackson-core 1Com.fasterxml.jackson.core:jackson-databind 1Tools.jackson.core:jackson-databind 1
CVE-2018-19362
Crítica · 9.8
CWE-502 02/01/2019
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19361
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19360
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-14721
Crítica · 10.0
CWE-918 02/01/2019
Server-Side Request Forgery (SSRF) in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVE-2018-14720
Crítica · 9.8
CWE-502 02/01/2019
XML External Entity Reference (XXE) in jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-14719
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2018-7489
Crítica · 9.8
CWE-184 26/02/2018
FasterXML jackson-databind allows unauthenticated remote code execution
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
CVE-2017-7525
Crítica · 9.8
CWE-184 06/02/2018
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-15095
Crítica · 9.8
CWE-502 06/02/2018
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVE-2018-5968
Alta · 8.1
CWE-184 22/01/2018
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated…
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.