CVE-2020-35490
- EPSS 3.92%
- Veröffentlicht 17.12.2020 19:15:14
- Zuletzt bearbeitet 21.11.2024 05:27:24
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-17527
- EPSS 11.07%
- Veröffentlicht 03.12.2020 19:15:12
- Zuletzt bearbeitet 21.11.2024 05:08:17
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request asso...
CVE-2020-25649
- EPSS 0.02%
- Veröffentlicht 03.12.2020 17:15:12
- Zuletzt bearbeitet 21.11.2024 05:18:20
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-24750
- EPSS 1.61%
- Veröffentlicht 17.09.2020 19:15:13
- Zuletzt bearbeitet 21.11.2024 05:16:00
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVE-2020-24616
- EPSS 2.68%
- Veröffentlicht 25.08.2020 18:15:11
- Zuletzt bearbeitet 21.11.2024 05:15:09
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVE-2020-13935
- EPSS 91.75%
- Veröffentlicht 14.07.2020 15:15:11
- Zuletzt bearbeitet 21.11.2024 05:02:10
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with inv...
CVE-2020-13934
- EPSS 23.38%
- Veröffentlicht 14.07.2020 15:15:11
- Zuletzt bearbeitet 21.11.2024 05:02:10
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException co...
CVE-2020-14195
- EPSS 9.51%
- Veröffentlicht 16.06.2020 16:15:11
- Zuletzt bearbeitet 21.11.2024 05:02:50
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
CVE-2020-14061
- EPSS 6.15%
- Veröffentlicht 14.06.2020 20:15:10
- Zuletzt bearbeitet 27.08.2025 21:15:35
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, o...
- EPSS 93.33%
- Veröffentlicht 20.05.2020 19:15:09
- Zuletzt bearbeitet 21.11.2024 05:40:44
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the Persiste...