Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
user can create a C:/ReleaseX64/ssl/openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. This impacts DLO server and client installations. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS20-012
CVE ID: CVE-2020-36166 State: PUBLISHED Published: 2021-01-06T00:51:38 Last Updated: 2024-08-04T17:23:09.399Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA through 6.1 on Windows, and InfoScale Operations Manager (aka VIOM) Windows Management Server 7.x through 7.4.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the \usr\local\ssl\openssl.cnf configuration file, which may not exist. On Windows systems, this path could tr
s to load the \usr\local\ssl\openssl.cnf configuration file, which may not exist. On Windows systems, this path could translate to <drive>:\usr\local\ssl\openssl.cnf, where <drive> could be the default Windows installation drive such as C:\ or the drive where a Veritas product is installed. By default, on Windows systems, users can create directories under any top-level directory. A low privileged user can create a <drive>:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, acc
. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS20-014
CVE ID: CVE-2020-36167 State: PUBLISHED Published: 2021-01-06T00:51:25 Last Updated: 2024-08-04T17:23:09.486Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. On start-up, it loads the OpenSSL library from the Installation folder. This library in turn attempts to load the /usr/local/ssl/openssl.cnf configuration file, which may not exist. On Windows systems, this path could translate to <drive>:\usr\local\ssl\openssl.cnf. A low privileged user can create a :\usr\local\ssl\opens
his path could translate to <drive>:\usr\local\ssl\openssl.cnf. A low privileged user can create a :\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. If the system is also an Active Directory domain controller, then this can affect the entire domain. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/429301 - https://www.veritas.com/content/support/en_US/security/VTS20-010
CVE ID: CVE-2020-36168 State: PUBLISHED Published: 2021-01-06T00:51:11 Last Updated: 2024-08-04T17:23:09.046Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Resiliency Platform 3.4 and 3.5. It leverages OpenSSL on Windows systems when using the Managed Host addon. On start-up, it loads the OpenSSL library. This library may attempt to load the openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user can create a C:\usr\local\ssl\openssl.cnf configuration file to load a malicious Open
s under C:\. A low privileged user can create a C:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS20-015
CVE ID: CVE-2020-36169 State: PUBLISHED Published: 2021-01-06T00:50:59 Last Updated: 2024-08-04T17:23:09.467Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1. Processes using OpenSSL attempt to load and execute libraries from paths that do not exist by default on the Windows operating system. By default, on Windows systems, users can create directories under the top level of any drive. If a low privileged user creates an affected path with a library that the Veritas product attempts to load, they can execute arbitrary
leged user creates an affected path with a library that the Veritas product attempts to load, they can execute arbitrary code as SYSTEM or Administrator. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. This vulnerability affects master servers, media servers, clients, and OpsCenter servers on the Windows platform. The system is vulnerable during an install or upgrade and post-install during normal operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS20-016#Issue1
CVE ID: CVE-2020-36170 State: PUBLISHED Published: 2021-01-06T13:55:43 Last Updated: 2024-08-04T17:23:09.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ultimate-member/#developers
CVE ID: CVE-2020-36171 State: PUBLISHED Published: 2021-01-06T14:06:28 Last Updated: 2024-08-04T17:23:09.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/elementor/#developers
CVE ID: CVE-2020-36172 State: PUBLISHED Published: 2021-01-06T14:17:41 Last Updated: 2024-08-04T17:23:09.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/advanced-custom-fields/#developers
CVE ID: CVE-2020-36173 State: PUBLISHED Published: 2021-01-06T14:32:07 Last Updated: 2024-08-04T17:23:09.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/#developers
CVE ID: CVE-2020-36174 State: PUBLISHED Published: 2021-01-06T14:31:44 Last Updated: 2024-08-04T17:23:09.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/#developers
CVE ID: CVE-2020-36175 State: PUBLISHED Published: 2021-01-06T14:31:54 Last Updated: 2024-08-04T17:23:09.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/#developers
CVE ID: CVE-2020-36176 State: PUBLISHED Published: 2021-01-06T14:47:34 Last Updated: 2024-08-04T17:23:09.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/better-wp-security/#developers
CVE ID: CVE-2020-36177 State: PUBLISHED Published: 2021-01-06T15:54:40 Last Updated: 2024-08-04T17:23:09.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/commit/63bf5dc56ccbfc12a73b06327361687091a4c6f7 - https://github.com/wolfSSL/wolfssl/pull/3426 - https://github.com/wolfSSL/wolfssl/commit/fb2288c46dd4c864b78f00a47a364b96a09a5c0f - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567 - https://github.com/wolfSSL/wolfssl/release
64b96a09a5c0f - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567 - https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable
CVE ID: CVE-2020-36178 State: PUBLISHED Published: 2021-01-06T20:57:57 Last Updated: 2024-08-04T17:23:09.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/fr/support/download/tl-wr840n/v6/#Firmware - https://therealunicornsecurity.github.io/TPLink/ - h
ttps://www.tp-link.com/fr/support/download/tl-wr840n/v6/#Firmware - https://therealunicornsecurity.github.io/TPLink/ - https://github.com/therealunicornsecurity/therealunicornsecurity.github.io/blob/master/_posts/2020-10-11-TPLink.md
CVE ID: CVE-2020-36179 State: PUBLISHED Published: 2021-01-06T22:30:38 Last Updated: 2024-08-04T17:23:09.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/3004 - https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180
ackson-databind/issues/3004 - https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436%40%3Cissues.spark.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36180 State: PUBLISHED Published: 2021-01-06T22:30:31 Last Updated: 2024-08-04T17:23:09.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/3004 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/se
on-databind/issues/3004 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36181 State: PUBLISHED Published: 2021-01-06T22:29:19 Last Updated: 2024-08-04T17:23:09.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/3004 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com
ckson-databind/issues/3004 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36182 State: PUBLISHED Published: 2021-01-06T22:30:22 Last Updated: 2024-08-04T17:23:09.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/3004 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.co
ackson-databind/issues/3004 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36183 State: PUBLISHED Published: 2021-01-06T22:30:15 Last Updated: 2024-08-04T17:23:09.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/3003 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36184 State: PUBLISHED Published: 2021-01-06T22:30:07 Last Updated: 2024-08-04T17:23:09.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2998 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracl
ML/jackson-databind/issues/2998 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36185 State: PUBLISHED Published: 2021-01-06T22:29:59 Last Updated: 2024-08-04T17:23:09.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2998 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuA
/2998 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36186 State: PUBLISHED Published: 2021-01-06T22:29:51 Last Updated: 2024-08-04T17:23:09.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2997 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuA
/2997 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36187 State: PUBLISHED Published: 2021-01-06T22:29:44 Last Updated: 2024-08-04T17:23:09.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2997 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuAp
2997 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36188 State: PUBLISHED Published: 2021-01-06T22:29:36 Last Updated: 2024-08-04T17:23:09.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2996 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alert
issues/2996 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-36189 State: PUBLISHED Published: 2021-01-06T22:29:28 Last Updated: 2024-08-04T17:23:09.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. Additional Analyst Notes: - CVE Program Container: References: - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://github.com/FasterXML/jackson-databind/issues/2996 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/secur
databind/issues/2996 - https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210205-0005/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html