Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 32

CVE-2020-11111

jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

CVSS 3.1 · 8.8 High EPSS 3.6% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 37 more
CVE-2020-14061

jackson-databind: serialization in weblogic/oracle-aqjms

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

CVSS 3.1 · 8.1 High EPSS 4.5% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 17 more
CVE-2020-36182

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 58 more
CVE-2020-36179

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1 · 8.8 High EPSS 17.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 56 more
CVE-2020-36184

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

CVSS 3.1 · 8.8 High EPSS 8.4% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Cloud Backup and 58 more
CVE-2020-11113

jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 39 more
CVE-2021-28165

jetty: Resource exhaustion when receiving an invalid large TLS frame

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1 · 7.5 High EPSS 53.9% KEV · Not listed
Vendors
Eclipse Jenkins Netapp and 2 more
Products
Jetty Jenkins Cloud Manager and 25 more
CVE-2021-34429

jetty: crafted URIs allow bypassing security constraints

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

CVSS 3.1 · 5.3 Medium EPSS 99.3% KEV · Not listed
Vendors
Eclipse Netapp Oracle and 1 more
Products
Jetty E-series Santricity Os Controller E-series Santricity Web Services and 17 more
CVE-2021-34428

jetty: SessionListener can prevent a session from being invalidated breaking logout

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Debian Eclipse Netapp and 2 more
Products
Debian Linux Jetty Active Iq Unified Manager and 18 more
CVE-2021-28164

jetty: Ambiguous paths can access WEB-INF

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS 3.1 · 5.3 Medium EPSS 82.4% KEV · Not listed
Vendors
Eclipse Netapp Oracle and 1 more
Products
Jetty Cloud Manager E-series Performance Analyzer and 20 more
CVE-2021-28163

jetty: Symlink directory exposes webapp directory contents

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

CVSS 3.1 · 2.7 Low EPSS 4.2% KEV · Not listed
Vendors
Apache Eclipse Fedoraproject and 3 more
Products
Ignite Solr Jetty and 27 more