Most recent entries from all

bdu:2020-04467

certfr-2021-avi-943 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-943

cnvd-2020-28476

EUVD-2026-40672

fkie_cve-2020-11620

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

GHSA-h4rc-386g-6m85 — jackson-databind mishandles the interaction between serialization gadgets and typing

Affected: Maven: com.fasterxml.jackson.core:jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

gsd-2020-11620

RHSA-2020:2067 — Red Hat Security Advisory: Red Hat build of Thorntail 2.5.1 security and bug fix update

thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol keycloak: missing signatures validation on CRL used to verify client certificates HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default keycloak: CSRF check missing in My Resources functionality in the Account Console keycloak: SAML broker does not check existence of signature on document allowing any user impersonation hibernate-validator: safeHTML validator allows XSS xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig keycloak: adapter endpoints are exposed via arbitrary URLs keycloak: cross-realm user access auth bypass wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use undertow: possible Denial Of Service (DOS) in Undertow HTTP server listen…

UBUNTU-CVE-2020-11620

Affected: Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

WID-SEC-W-2024-0794 — Dell ECS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.