Show filters
27 Total Results
Displaying 11-20 of 27
Sort by:
Attacker Value
Unknown
CVE-2021-29425
Disclosure Date: April 13, 2021 (last updated November 08, 2023)
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
0
Attacker Value
Unknown
CVE-2020-11987
Disclosure Date: February 24, 2021 (last updated February 01, 2024)
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
0
Attacker Value
Unknown
CVE-2020-14195
Disclosure Date: June 16, 2020 (last updated November 28, 2024)
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
0
Attacker Value
Unknown
CVE-2020-14060
Disclosure Date: June 14, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
0
Attacker Value
Unknown
CVE-2020-14061
Disclosure Date: June 14, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
0
Attacker Value
Unknown
CVE-2020-14062
Disclosure Date: June 14, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
0
Attacker Value
Unknown
CVE-2020-11112
Disclosure Date: March 31, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
0
Attacker Value
Unknown
CVE-2020-11111
Disclosure Date: March 31, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
0
Attacker Value
Unknown
CVE-2020-11113
Disclosure Date: March 31, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
0
Attacker Value
Unknown
CVE-2020-10969
Disclosure Date: March 26, 2020 (last updated November 08, 2023)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
0
