Fasterxml Jackson-Databind vulnerabilities
70 known vulnerabilities affecting fasterxml/jackson-databind.
Total CVEs
70
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL26HIGH41MEDIUM3
Vulnerabilities
Page 4 of 4
CVE-2018-14720CRITICALCVSS 9.8≥ 2.6.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.5+5 more2019-01-02
CVE-2018-14720 [CRITICAL] CWE-502 CVE-2018-14720: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XX
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
nvd
CVE-2018-14721CRITICALCVSS 10.0≥ 2.6.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.5+5 more2019-01-02
CVE-2018-14721 [CRITICAL] CWE-918 CVE-2018-14721: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side requ
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
nvd
CVE-2018-19360CRITICALCVSS 9.8≥ 2.6.0, ≤ 2.6.7.2≥ 2.7.0, < 2.7.9.5+2 more2019-01-02
CVE-2018-19360 [CRITICAL] CWE-502 CVE-2018-19360: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leve
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
nvd
CVE-2018-19361CRITICALCVSS 9.8≥ 2.6.0, ≤ 2.6.7.2≥ 2.7.0, < 2.7.9.5+2 more2019-01-02
CVE-2018-19361 [CRITICAL] CWE-502 CVE-2018-19361: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leve
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
nvd
CVE-2018-19362CRITICALCVSS 9.8≥ 2.6.0, ≤ 2.6.7.2≥ 2.7.0, < 2.7.9.5+2 more2019-01-02
CVE-2018-19362 [CRITICAL] CWE-502 CVE-2018-19362: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leve
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
nvd
CVE-2018-7489CRITICALCVSS 9.8fixed in 2.7.9.3≥ 2.8.0, < 2.8.11.1+1 more2018-02-26
CVE-2018-7489 [CRITICAL] CVE-2018-7489: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unaut
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if t
nvd
CVE-2017-7525CRITICALCVSS 9.8fixed in 2.6.7.1≥ 2.7.0, < 2.7.9.1+2 more2018-02-06
CVE-2017-7525 [CRITICAL] CWE-184 CVE-2017-7525: A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
cvelistv5nvd
CVE-2017-15095CRITICALCVSS 9.8≥ 2.0.0, < 2.6.7.2≥ 2.7.0, < 2.7.9.2+2 more2018-02-06
CVE-2017-15095 [CRITICAL] CWE-184 CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, w
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be us
cvelistv5nvd
CVE-2018-5968HIGHCVSS 8.1≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.2+2 more2018-01-22
CVE-2018-5968 [HIGH] CVE-2018-5968: FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
nvd
CVE-2017-17485CRITICALCVSS 9.8fixed in 2.6.7.3≥ 2.7.0, < 2.7.9.2+2 more2018-01-10
CVE-2017-17485 [CRITICAL] CWE-502 CVE-2017-17485: FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring li
nvd
← Previous4 / 4