Search for packages
| purl | pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5te6-415m-c7df
Aliases: CVE-2020-24750 GHSA-qjw2-hr98-qgfh |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. |
Affected by 11 other vulnerabilities. |
|
VCID-9h46-72hw-bkcr
Aliases: CVE-2022-42003 GHSA-jjjh-jjxp-wpff |
Multiple vulnerabilities have been found in FasterXML jackson-databind, the worst of which could result in denial of service. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-cytp-mr4h-g3ds
Aliases: CVE-2020-36184 GHSA-m6x4-97wx-4q27 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. |
Affected by 3 other vulnerabilities. |
|
VCID-hwnx-vf4v-f3db
Aliases: CVE-2020-24616 GHSA-h3cw-g4mq-c5x2 |
Code Injection in jackson-databind This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). |
Affected by 11 other vulnerabilities. |
|
VCID-jcgb-bewy-4kff
Aliases: CVE-2020-36185 GHSA-8w26-6f25-cm9x |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource`. |
Affected by 3 other vulnerabilities. |
|
VCID-swqd-uk56-wkat
Aliases: CVE-2020-35491 GHSA-r3gr-cxrf-hg25 |
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource. |
Affected by 3 other vulnerabilities. |
|
VCID-u87p-2xgz-e3fj
Aliases: CVE-2020-36187 GHSA-r695-7vr9-jgc2 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. |
Affected by 3 other vulnerabilities. |
|
VCID-ukwd-7rkh-sfhj
Aliases: CVE-2020-35728 GHSA-5r5r-6hpj-8gg9 |
Deserialization of Untrusted Data FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl). |
Affected by 3 other vulnerabilities. |
|
VCID-v2pq-1qhm-4qb9
Aliases: CVE-2022-42004 GHSA-rgv9-q543-rqg4 |
Multiple vulnerabilities have been found in FasterXML jackson-databind, the worst of which could result in denial of service. |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-v6ek-y7cn-kycd
Aliases: CVE-2020-36518 GHSA-57j2-w4cx-62h2 |
Uncontrolled Resource Consumption jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-w51e-ntqd-8bbg
Aliases: CVE-2020-25649 GHSA-288c-cq4h-88gq |
XML External Entity (XXE) Injection in Jackson Databind A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. |
Affected by 10 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-wds4-urpb-euby
Aliases: CVE-2020-36186 GHSA-v585-23hc-c647 |
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource`. |
Affected by 3 other vulnerabilities. |
|
VCID-ypbt-p34k-hfbc
Aliases: CVE-2020-35490 GHSA-wh8g-3j2c-rqj5 |
Serialization gadgets exploit in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-3qjf-azsa-fbek | Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). |
CVE-2020-14060
GHSA-j823-4qch-3rgm |
| VCID-pnt3-1ssq-tqau | Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms). |
CVE-2020-14061
GHSA-c2q3-4qrh-fm48 |
| VCID-uygc-h93v-vuh8 | Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2). |
CVE-2020-14062
GHSA-c265-37vj-cwcc |
| VCID-ze79-6kcg-nfcp | Deserialization of untrusted data in Jackson Databind FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). |
CVE-2020-14195
GHSA-mc6h-4qgp-37qh |