Fasterxml: >> Jackson-Databind >> 2.7.9.4 Security Vulnerabilities
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVSS Score
9.8
EPSS Score
0.033
Published
2019-01-02
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVSS Score
10.0
EPSS Score
0.094
Published
2019-01-02
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVSS Score
9.8
EPSS Score
0.067
Published
2019-01-02
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVSS Score
9.8
EPSS Score
0.024
Published
2019-01-02
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVSS Score
9.8
EPSS Score
0.041
Published
2019-01-02
Page 5