Overview 6 matches · 0 protected · 2 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
6
100.0%
No exploit published
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
6
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
33.3%
Working exploit published
0
0.0%
Proof of concept only
4
66.7%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 3 / month
Mar 203
Mitigation candidate3
Critical2
High1
not blocked3
Exploited2
Proof of concept only1
Apr 200
May 200
Jun 200
Jul 200
Aug 200
Sep 200
Oct 200
Nov 200
Dec 201
Mitigation candidate1
High1
not blocked1
Proof of concept only1
Jan 212
Mitigation candidate2
High2
not blocked2
Proof of concept only2
Mar 20Apr 20May 20Jun 20Jul 20Aug 20Sep 20Oct 20Nov 20Dec 20Jan 21
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-36179 | High | 2021-01-07 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. |
| CVE-2020-36184 | High | 2021-01-06 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. |
| CVE-2020-35728 | High | 2020-12-27 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl). |
| CVE-2020-10673 | High | 2020-03-18 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). |
| CVE-2020-9548 | Critical | 2020-03-02 | Mitigation candidate | Exploited | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). |
| CVE-2020-9547 | Critical | 2020-03-02 | Mitigation candidate | Exploited | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). |