WaratekVRT Sign in
Reset
More filters (2)
Columns
Vendor com.fasterxml.jackson.core✕Has a public PoC✕
Overview 5 matches · 2 protected · 2 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
5matches 2protected40.0% 2exploited40.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 3 60.0% No exploit published 0 0.0%
Critical 5 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 40.0% partly blocked 0 0.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 0 0.0% Proof of concept only 3 60.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / quarter
Mitigation candidate: 3Protected by Waratek: 2 Critical: 5 not blocked: 3blocked by ARMR today: 2 Proof of concept only: 3Exploited: 2
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 191 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q4 190 Q1 203 Mitigation candidate3 Critical3 not blocked3 Exploited2 Proof of concept only1
Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19Q4 19Q1 20
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-9548 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2020-8840 Critical 2020-02-10 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVE-2019-14540 Critical 2019-09-15 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.