WaratekVRT Sign in
Reset
More filters (2)
Columns
Vendor com.fasterxml.jackson.core✕Has a public PoC✕
Overview 6 matches · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
6matches 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 6 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 33.3% High 2 33.3% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 6 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 6 100.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Protected by Waratek: 6 Medium: 2High: 2Critical: 2 blocked by ARMR today: 6 Proof of concept only: 6
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 192 Protected by Waratek2 Medium2 blocked by ARMR today2 Proof of concept only2 Q3 192 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 Proof of concept only2 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 211 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1
Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-36188 High 2021-01-06 Protected by Waratek Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2019-14540 Critical 2019-09-15 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-12384 Medium 2019-06-24 Protected by Waratek Proof of concept only FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVE-2019-12814 Medium 2019-06-19 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.