Skip to content
COOEY

FAIL › dossier

fasterxml

VENDOR

Failure events
25
Zero-days
0
RCEs
0
On KEV
0
Critical
25
Worst shame
0
Dossier not yet built — the RAG curator builds one for players with ≥2 failure events. The failure history and sentiment below are live.
FAILURE HISTORY · 25
DATEEVENTSEVSUMMARY
2020-03-02 CVE-2020-9546 critical CVE-2020-9546: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
2020-03-02 CVE-2020-9548 critical CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
2020-03-02 CVE-2020-9547 critical CVE-2020-9547: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
2020-03-02 CVE-2019-14892 critical CVE-2019-14892: A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 an
2020-03-02 CVE-2019-14893 critical CVE-2019-14893: A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.1
2020-02-10 CVE-2020-8840 critical CVE-2020-8840: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JN
2020-01-03 CVE-2019-20330 critical CVE-2019-20330: FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache bloc
2019-10-12 CVE-2019-17531 critical CVE-2019-17531: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th
2019-10-07 CVE-2019-17267 critical CVE-2019-17267: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2
2019-10-01 CVE-2019-16942 critical CVE-2019-16942: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th
2019-10-01 CVE-2019-16943 critical CVE-2019-16943: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th
2019-09-15 CVE-2019-16335 critical CVE-2019-16335: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2
2019-09-15 CVE-2019-14540 critical CVE-2019-14540: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2
2019-07-29 CVE-2019-14379 critical CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles de
2019-07-09 CVE-2018-11307 critical CVE-2018-11307: An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use o
2019-01-02 CVE-2018-14718 critical CVE-2018-14718: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec
2019-01-02 CVE-2018-14721 critical CVE-2018-14721: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to cond
2019-01-02 CVE-2018-14719 critical CVE-2018-14719: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec
2019-01-02 CVE-2018-19361 critical CVE-2018-19361: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec
2019-01-02 CVE-2018-19360 critical CVE-2018-19360: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec
2019-01-02 CVE-2018-14720 critical CVE-2018-14720: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct ext
2019-01-02 CVE-2018-19362 critical CVE-2018-19362: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec
2018-02-26 CVE-2018-7489 critical CVE-2018-7489: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x befor
2018-02-06 CVE-2017-15095 critical CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before
2018-02-06 CVE-2017-7525 critical CVE-2017-7525: A deserialization flaw was discovered in the jackson-databind, versions before 2
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Vulnerability allowed arbitrary code execution via polymorphic deserialization, widely recognized as a critical flaw in jackson-databind.
synthesisneutral+0.00
No coverage or sentiment data available from provided sources.
cooey ↗severe-fallout-0.80
Critical flaw enabling arbitrary code execution via polymorphic deserialization, widely acknowledged as a severe vulnerability.
"A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS or in any other way which ObjectMapper.readValue migh"
127.0.0.1 ↗severe-fallout+0.00
No usable content; bridge error prevents sentiment assessment.
cooey ↗neutral+0.00
No coverage or sentiment data available from provided sources.
127.0.0.1 ↗neutral+0.00
No coverage or sentiment data available from provided sources.