← Back

Jackson Databind

jackson-databind

Vendor: Fasterxml • 78 CVEs

CVEs (78)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-36188
4Debian
FasterxmlNetapp+1 more
45Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+42 more
Oct 8, 2026
Jan 6, 2021
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-36187
4Debian
FasterxmlNetapp+1 more
45Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+42 more
Oct 8, 2026
Jan 6, 2021
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
CVE-2020-36186
4Debian
FasterxmlNetapp+1 more
45Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+42 more
Oct 8, 2026
Jan 6, 2021
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
CVE-2020-36185
4Debian
FasterxmlNetapp+1 more
45Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+42 more
Oct 8, 2026
Jan 6, 2021
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
CVE-2020-36184
4Debian
FasterxmlNetapp+1 more
46Agile Plm
Agile Product Lifecycle ManagementApplication Testing Suite+43 more
Aug 25, 2026
Jan 6, 2021
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-36181
4Debian
FasterxmlNetapp+1 more
45Agile Plm
Agile Product Lifecycle ManagementApplication Testing Suite+42 more
Aug 25, 2026
Jan 6, 2021
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-35728
4Debian
FasterxmlNetapp+1 more
41Agile Plm
Agile Product Lifecycle ManagementApplication Testing Suite+38 more
Aug 25, 2026
Dec 27, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org....Show more
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).Show less
CVE-2020-35491
4Debian
FasterxmlNetapp+1 more
26Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+23 more
Oct 8, 2026
Dec 17, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
CVE-2020-35490
4Debian
FasterxmlNetapp+1 more
25Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+22 more
Oct 8, 2026
Dec 17, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-25649
6Apache
FasterxmlFedoraproject+3 more
39Agile Product Lifecycle Management
Agile Product Lifecycle Management Integration PackBanking Apis+36 more
Oct 8, 2026
Dec 3, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is...Show more
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.Show less
CVE-2020-24750
3Debian
FasterxmlOracle
26Agile Product Lifecycle Management
Application Testing SuiteAutovue For Agile Product Lifecycle Management+23 more
Oct 8, 2026
Sep 17, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVE-2020-24616
4Debian
FasterxmlNetapp+1 more
25Active Iq Unified Manager
Agile Product Lifecycle ManagementApplication Testing Suite+22 more
Oct 8, 2026
Aug 25, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVE-2020-14195
4Debian
FasterxmlNetapp+1 more
14Active Iq Unified Manager
Agile Product Lifecycle ManagementBanking Digital Experience+11 more
Oct 8, 2026
Jun 16, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
CVE-2020-14060
3Fasterxml
NetappOracle
12Active Iq Unified Manager
Agile Product Lifecycle ManagementBanking Digital Experience+9 more
Oct 8, 2026
Jun 14, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
CVE-2020-14062
4Debian
FasterxmlNetapp+1 more
13Active Iq Unified Manager
Agile Product Lifecycle ManagementBanking Digital Experience+10 more
Oct 8, 2026
Jun 14, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
CVE-2020-14061
4Debian
FasterxmlNetapp+1 more
16Active Iq Unified Manager
Agile PlmAgile Product Lifecycle Management+13 more
Aug 25, 2026
Jun 14, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms....Show more
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).Show less
CVE-2020-11620
4Debian
FasterxmlNetapp+1 more
18Active Iq Unified Manager
Banking PlatformCommunications Contacts Server+15 more
Oct 8, 2026
Apr 7, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11619
4Debian
FasterxmlNetapp+1 more
21Active Iq Unified Manager
Agile Product Lifecycle ManagementBanking Platform+18 more
Oct 8, 2026
Apr 7, 2020
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-11113
4Debian
FasterxmlNetapp+1 more
33Agile Plm
Agile Product Lifecycle ManagementAutovue For Agile Product Lifecycle Management+30 more
Aug 25, 2026
Mar 31, 2020
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-11112
4Debian
FasterxmlNetapp+1 more
32Agile Plm
Agile Product Lifecycle ManagementAutovue For Agile Product Lifecycle Management+29 more
Aug 25, 2026
Mar 31, 2020
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).