Mon, May 18 · 03:59 PM CDTCVE-2015-3306
10.0/10 · Must read/watchNVDvuln
Summary
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVECVE-2015-3306
SeverityCRITICAL
TypeUPDATED
PublishedMon, May 18 · 03:59 PM CDT
ModifiedFri, Oct 09 · 04:17 AM CDT
CVE-2013-7285
9.8/10 · Must read/watchNVDvuln
Summary
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVECVE-2013-7285
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 15 · 05:29 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2016-0718
9.8/10 · Must read/watchNVDvuln
Summary
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVECVE-2016-0718
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 26 · 04:59 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2016-9063
9.8/10 · Must read/watchNVDvuln
Summary
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
CVECVE-2016-9063
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 11 · 09:29 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2016-9841
9.8/10 · Must read/watchNVDvuln
Summary
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVECVE-2016-9841
SeverityCRITICAL
TypeUPDATED
PublishedTue, May 23 · 04:29 AM CDT
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2017-1000158
9.8/10 · Must read/watchNVDvuln
Summary
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
CVECVE-2017-1000158
SeverityCRITICAL
TypeUPDATED
PublishedFri, Nov 17 · 05:29 AM CST
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2017-15095
9.8/10 · Must read/watchNVDvuln
Summary
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting
CVECVE-2017-15095
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 06 · 03:29 PM CST
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2017-5645
9.8/10 · Must read/watchNVDvuln
Summary
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVECVE-2017-5645
SeverityCRITICAL
TypeUPDATED
PublishedMon, Apr 17 · 09:59 PM CDT
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2017-7525
9.8/10 · Must read/watchNVDvuln
Summary
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVECVE-2017-7525
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 06 · 03:29 PM CST
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2018-1000802
9.8/10 · Must read/watchNVDvuln
Summary
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or e
CVECVE-2018-1000802
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 18 · 05:29 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2018-11307
9.8/10 · Must read/watchNVDvuln
Summary
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
CVECVE-2018-11307
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 09 · 04:15 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2018-1270
9.8/10 · Must read/watchNVDvuln
Summary
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can
CVECVE-2018-1270
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 06 · 01:29 PM CDT
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2018-14718
9.8/10 · Must read/watchNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVECVE-2018-14718
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jan 02 · 06:29 PM CST
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2018-14719
9.8/10 · Must read/watchNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVECVE-2018-14719
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jan 02 · 06:29 PM CST
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-13962
9.8/10 · Must read/watchNVDvuln
Summary
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVECVE-2019-13962
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 18 · 08:15 PM CDT
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2019-14379
9.8/10 · Must read/watchNVDvuln
Summary
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVECVE-2019-14379
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jul 29 · 12:15 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-14540
9.8/10 · Must read/watchNVDvuln
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVECVE-2019-14540
SeverityCRITICAL
TypeUPDATED
PublishedSun, Sep 15 · 10:15 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-14892
9.8/10 · Must read/watchNVDvuln
Summary
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
CVECVE-2019-14892
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 02 · 05:15 PM CST
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-14893
9.8/10 · Must read/watchNVDvuln
Summary
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using
CVECVE-2019-14893
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 02 · 09:15 PM CST
ModifiedThu, Oct 08 · 10:16 PM CDT
CVE-2019-16335
9.8/10 · Must read/watchNVDvuln
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVECVE-2019-16335
SeverityCRITICAL
TypeUPDATED
PublishedSun, Sep 15 · 10:15 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-16942
9.8/10 · Must read/watchNVDvuln
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpo
CVECVE-2019-16942
SeverityCRITICAL
TypeUPDATED
PublishedTue, Oct 01 · 05:15 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-17531
9.8/10 · Must read/watchNVDvuln
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a
CVECVE-2019-17531
SeverityCRITICAL
TypeUPDATED
PublishedSat, Oct 12 · 09:15 PM CDT
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2019-20330
9.8/10 · Must read/watchNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVECVE-2019-20330
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jan 03 · 04:15 AM CST
ModifiedThu, Oct 08 · 07:16 PM CDT
CVE-2020-8840
9.8/10 · Must read/watchNVDvuln
Summary
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVECVE-2020-8840
SeverityCRITICAL
TypeUPDATED
PublishedMon, Feb 10 · 09:56 PM CST
ModifiedThu, Oct 08 · 09:17 PM CDT
CVE-2020-9548
9.8/10 · Must read/watchNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVECVE-2020-9548
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 02 · 04:15 AM CST
ModifiedThu, Oct 08 · 07:16 PM CDT
