Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

maven/com.fasterxml.jackson.core:jackson-databindCode Injection

Risk 77
Severity
8.1
Code Injection
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

1 / 2
Source: MITRE
First published (updated )
CVE-2020-24616

maven/com.fasterxml.jackson.core:jackson-databindA flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gad…

Risk 78
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 3
First published (updated )
CVE-2020-35728

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 78
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36188

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 80
Severity
8.8
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36180

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 80
Severity
8.8
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36182

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 77
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36183

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 80
Severity
8.8
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36179

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 77
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36185

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 80
Severity
8.8
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36181

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 77
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4
First published (updated )
CVE-2020-36186

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 80
Severity
8.8
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 3
First published (updated )
CVE-2020-36184

maven/com.fasterxml.jackson.core:jackson-databindFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadg…

Risk 77
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 3
First published (updated )
CVE-2020-36187

redhat/xstreamRemote Code Execution in XStream

Risk 83
Severity
9.3
OS Command Injection
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 5

Remedy

Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address. Allow list approach ```java XStream xstream = new XStream(); XStream.setupDefaultSecurity(xstream); xstream.allowTypesByWildcard(new String[] {"com.misc.classname"}) ``` Deny list for XStream 1.4.13 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); ``` Deny list for XStream 1.4.7 -> 1.4.12 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); ``` Deny list for versions prior to XStream 1.4.7 ```java xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type)); } public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW); ```
First published (updated )
CVE-2020-26217

Apache PDFBoxXEE

Risk 88
Severity
9.8
XEE
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

1 / 2
First published (updated )
CVE-2019-0228

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203