Записи FasterXML
86 опубликованных записей вендора fasterxml.
Профиль для исследователя
- Попали в KEV
- 0 · 0 %
- С эксплойтом
- 0 · 0 %
- Pre-auth RCE
- 9
- С записью об исправлении
- 100 %
- Медиана: публикация → KEV
- Ни одна запись не попала в KEV
Повторяющиеся классы
- CWE-502 Deserialization of Untrusted Data58
- CWE-184 Incomplete List of Disallowed Inputs6
- CWE-770 Allocation of Resources Without Limits or Throttling4
- CWE-611 Improper Restriction of XML External Entity Reference3
- CWE-918 Server-Side Request Forgery (SSRF)2
- CWE-20 Improper Input Validation2
Классы уязвимостей, которые чаще всего встречаются у этого вендора: куда смотреть.
CWEВсе записи
86 записей| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
54В плане | CVE-2017-17485Proof of concept | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 49,7 % | 10 янв. 2018 г. |
50В плане | CVE-2017-7525Proof of concept | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticafasterxml · jackson-databind · CWE-184 | Критическая9,8 | — | 37,7 % | 6 февр. 2018 г. |
47В плане | CVE-2020-8840Proof of concept | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedifasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 26,6 % | 10 февр. 2020 г. |
45В плане | CVE-2018-7489Proof of concept | FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution becausefasterxml · jackson-databind · CWE-184 | Критическая9,8 | — | 19,8 % | 26 февр. 2018 г. |
45В плане | CVE-2020-9547Proof of concept | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 18,4 % | 2 мар. 2020 г. |
45В плане | CVE-2020-9548Proof of concept | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anterofasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 18,3 % | 2 мар. 2020 г. |
43В плане | CVE-2018-14718Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 12,7 % | 2 янв. 2019 г. |
43В плане | CVE-2018-14721Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveragingfasterxml · jackson-databind · CWE-918 | Критическая10,0 | — | 10,5 % | 2 янв. 2019 г. |
42В плане | CVE-2019-14540Proof of concept | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,8 % | 15 сент. 2019 г. |
42В плане | CVE-2018-19361Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clasfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,6 % | 2 янв. 2019 г. |
42В плане | CVE-2018-19360Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transpfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,6 % | 2 янв. 2019 г. |
42В плане | CVE-2018-19362Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-commonfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 10,6 % | 2 янв. 2019 г. |
42В плане | CVE-2018-14719Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 9,7 % | 2 янв. 2019 г. |
42В плане | CVE-2019-20330Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 8,6 % | 3 янв. 2020 г. |
42В плане | CVE-2017-15095Эксплойта нет | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated userfasterxml · jackson-databind · CWE-184 | Критическая9,8 | — | 8,4 % | 6 февр. 2018 г. |
41В плане | CVE-2019-14379Эксплойта нет | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcachefasterxml · jackson-databind · CWE-1321 | Критическая9,8 | — | 8,1 % | 29 июл. 2019 г. |
41В плане | CVE-2018-14720Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to blocfasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 7,5 % | 2 янв. 2019 г. |
41В плане | CVE-2018-11307Эксплойта нет | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 5,7 % | 9 июл. 2019 г. |
41В плане | CVE-2019-16942Эксплойта нет | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 5,7 % | 1 окт. 2019 г. |
41В плане | CVE-2019-14892Эксплойта нет | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserializationfasterxml · jackson-databind · CWE-200 | Критическая9,8 | — | 5,6 % | 2 мар. 2020 г. |
41В плане | CVE-2019-17531Эксплойта нет | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 5,4 % | 12 окт. 2019 г. |
40В плане | CVE-2019-16335Эксплойта нет | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 5,0 % | 15 сент. 2019 г. |
40В плане | CVE-2019-16943Эксплойта нет | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 4,9 % | 1 окт. 2019 г. |
40В плане | CVE-2019-17267Эксплойта нет | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.fasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 4,6 % | 6 окт. 2019 г. |
40В плане | CVE-2020-9546Эксплойта нет | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hafasterxml · jackson-databind · CWE-502 | Критическая9,8 | — | 4,6 % | 2 мар. 2020 г. |
- CVE-2017-1748554В плане
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
КритическаяCVSS 9,8Proof of conceptEPSS 50 %fasterxml · jackson-databind10 янв. 2018 г.
- CVE-2017-752550В плане
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica
КритическаяCVSS 9,8Proof of conceptEPSS 38 %fasterxml · jackson-databind6 февр. 2018 г.
- CVE-2020-884047В плане
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi
КритическаяCVSS 9,8Proof of conceptEPSS 27 %fasterxml · jackson-databind10 февр. 2020 г.
- CVE-2018-748945В плане
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because
КритическаяCVSS 9,8Proof of conceptEPSS 20 %fasterxml · jackson-databind26 февр. 2018 г.
- CVE-2020-954745В плане
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq
КритическаяCVSS 9,8Proof of conceptEPSS 18 %fasterxml · jackson-databind2 мар. 2020 г.
- CVE-2020-954845В плане
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero
КритическаяCVSS 9,8Proof of conceptEPSS 18 %fasterxml · jackson-databind2 мар. 2020 г.
- CVE-2018-1471843В плане
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-
КритическаяCVSS 9,8Эксплойта нетEPSS 13 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1472143В плане
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging
КритическаяCVSS 10,0Эксплойта нетEPSS 10 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2019-1454042В плане
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
КритическаяCVSS 9,8Proof of conceptEPSS 11 %fasterxml · jackson-databind15 сент. 2019 г.
- CVE-2018-1936142В плане
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa clas
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1936042В плане
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transp
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1936242В плане
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1471942В плане
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2019-2033042В плане
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
КритическаяCVSS 9,8Эксплойта нетEPSS 9 %fasterxml · jackson-databind3 янв. 2020 г.
- CVE-2017-1509542В плане
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user
КритическаяCVSS 9,8Эксплойта нетEPSS 8 %fasterxml · jackson-databind6 февр. 2018 г.
- CVE-2019-1437941В плане
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache
КритическаяCVSS 9,8Эксплойта нетEPSS 8 %fasterxml · jackson-databind29 июл. 2019 г.
- CVE-2018-1472041В плане
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to bloc
КритическаяCVSS 9,8Эксплойта нетEPSS 8 %fasterxml · jackson-databind2 янв. 2019 г.
- CVE-2018-1130741В плане
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.
КритическаяCVSS 9,8Эксплойта нетEPSS 6 %fasterxml · jackson-databind9 июл. 2019 г.
- CVE-2019-1694241В плане
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
КритическаяCVSS 9,8Эксплойта нетEPSS 6 %fasterxml · jackson-databind1 окт. 2019 г.
- CVE-2019-1489241В плане
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization
КритическаяCVSS 9,8Эксплойта нетEPSS 6 %fasterxml · jackson-databind2 мар. 2020 г.
- CVE-2019-1753141В плане
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
КритическаяCVSS 9,8Эксплойта нетEPSS 5 %fasterxml · jackson-databind12 окт. 2019 г.
- CVE-2019-1633540В плане
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
КритическаяCVSS 9,8Эксплойта нетEPSS 5 %fasterxml · jackson-databind15 сент. 2019 г.
- CVE-2019-1694340В плане
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
КритическаяCVSS 9,8Эксплойта нетEPSS 5 %fasterxml · jackson-databind1 окт. 2019 г.
- CVE-2019-1726740В плане
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
КритическаяCVSS 9,8Эксплойта нетEPSS 5 %fasterxml · jackson-databind6 окт. 2019 г.
- CVE-2020-954640В плане
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ha
КритическаяCVSS 9,8Эксплойта нетEPSS 5 %fasterxml · jackson-databind2 мар. 2020 г.