WaratekVRT Sign in

Oracle Retail Applications Segment (jackson-databind) CVEs

3 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Oracle product: Oracle Retail Applications / Segment (jackson-databind)✕
Overview 3 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
3matches 0exploited0.0% 0CISA KEV0.0% 1public PoC33.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 2 66.7% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 2 66.7%
split by peak 2 / quarter
Protected by Waratek: 3 Medium: 1High: 2 blocked by ARMR today: 3 No public exploit: 2Proof of concept only: 1
Q2 192 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 Proof of concept only1 No public exploit1 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q2 19Q3 19Q4 19Q1 20Q2 20Q3 20Q4 20
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-25649 High 2020-12-03 Protected by Waratek No public exploit A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2019-12814 Medium 2019-06-19 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
CVE-2019-12086 High 2019-05-17 Protected by Waratek No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.