WaratekVRT Sign in

Oracle Support Tools Trace File Analyzer (TFA) Collector (jackson-databind) CVEs

3 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Oracle product: Oracle Support Tools / Trace File Analyzer (TFA) Collector (jackson-databind)✕
Overview 3 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
3matches 0exploited0.0% 0CISA KEV0.0% 1public PoC33.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 1 33.3% Medium 2 66.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 2 66.7%
split by peak 1 / month
Protected by Waratek: 3 Medium: 2High: 1 blocked by ARMR today: 3 No public exploit: 2Proof of concept only: 1
Dec 181 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Jan 190 Feb 190 Mar 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Apr 190 May 190 Jun 191 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1
Dec 18Jan 19Feb 19Mar 19Apr 19May 19Jun 19
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-12814 Medium 2019-06-19 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
CVE-2018-12022 High 2019-03-21 Protected by Waratek No public exploit An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-1000873 Medium 2018-12-20 Protected by Waratek No public exploit Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.