Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15043 State: PUBLISHED Published: 2018-05-04T20:00:00 Last Updated: 2024-08-05T19:42:22.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9 could allow an authenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. This vulnerability is due to insufficient input validation on user-controlled input in an HTTP request to the targeted device. An attacker in possession of router login credenti
n on user-controlled input in an HTTP request to the targeted device. An attacker in possession of router login credentials could exploit this vulnerability by sending a crafted HTTP request to an affected system. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/swi-psa-2018-003-technical-bulletin-reaper/
CVE ID: CVE-2017-15044 State: PUBLISHED Published: 2017-11-21T13:00:00 Last Updated: 2024-08-05T19:42:22.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by modifying text. The default installation is unsafe because the server listens on the network interface, not the localhost interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/
host interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/541548
CVE ID: CVE-2017-15045 State: PUBLISHED Published: 2017-10-06T04:00:00 Last Updated: 2024-08-05T19:42:22.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/lame/bugs/478/ - https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2017-15045
CVE ID: CVE-2017-15046 State: PUBLISHED Published: 2017-10-06T04:00:00 Last Updated: 2024-08-05T19:42:22.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/lame/bugs/479/
CVE ID: CVE-2017-15047 State: PUBLISHED Published: 2017-10-06T04:00:00 Last Updated: 2024-08-05T19:42:22.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging "limited access to the machine." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/antirez/redis/issues/4278 - https://security.gentoo.org/glsa/202008-17
CVE ID: CVE-2017-15048 State: PUBLISHED Published: 2017-12-19T15:00:00 Last Updated: 2024-08-05T19:42:22.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145452/Zoom-Linux-Client-2.0.106600.0904-Buffer-Overflow.html - https://github.com/convisoappsec/advisories/blob/master/2017/CONVISO-17-002.txt - http://seclists.org/fulldisclosure/2017/Dec/46 - https://www.exploit-db.com/explo
/blob/master/2017/CONVISO-17-002.txt - http://seclists.org/fulldisclosure/2017/Dec/46 - https://www.exploit-db.com/exploits/43355/
CVE ID: CVE-2017-15049 State: PUBLISHED Published: 2017-12-19T15:00:00 Last Updated: 2024-08-05T19:42:22.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145453/Zoom-Linux-Client-2.0.106600.0904-Command-Injection.html - https://www.exploit-db.com/exploits/43354/ - https://github.com/convisoappsec/advisories/blob/master/2017/CONVISO
html - https://www.exploit-db.com/exploits/43354/ - https://github.com/convisoappsec/advisories/blob/master/2017/CONVISO-17-003.txt - http://seclists.org/fulldisclosure/2017/Dec/47
CVE ID: CVE-2017-15051 State: PUBLISHED Published: 2017-11-27T19:00:00 Last Updated: 2024-08-05T19:42:22.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to m
. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed. Additional Analyst Notes: - CVE Program Container: References: - http://blog.amossys.fr/teampass-multiple-cve-01.html - https://github.com/nilsteampassnet/TeamPass/commit/5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15f
CVE ID: CVE-2017-15052 State: PUBLISHED Published: 2017-11-27T19:00:00 Last Updated: 2024-08-05T19:42:22.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_user" on users.queries.php. Additional Analyst Notes: -
or example by changing the "id" parameter when invoking "delete_user" on users.queries.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.amossys.fr/teampass-multiple-cve-01.html - https://github.com/nilsteampassnet/TeamPass/commit/8f2d51dd6c24f76e4f259d0df22cff9b275f2dd1
CVE ID: CVE-2017-15053 State: PUBLISHED Published: 2017-11-27T19:00:00 Last Updated: 2024-08-05T19:42:22.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_role" on roles.queries.php. Additional Analyst Notes: - CVE Program Container: Refer
id" parameter when invoking "delete_role" on roles.queries.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.amossys.fr/teampass-multiple-cve-01.html - https://github.com/nilsteampassnet/TeamPass/commit/ef32e9c28b6ddc33cee8a25255bc8da54434af3e
CVE ID: CVE-2017-15054 State: PUBLISHED Published: 2017-11-27T19:00:00 Last Updated: 2024-08-05T19:42:22.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in order to select the correct branch and be able to upload any arbitrary file. From there, it can simply access the file to execute code on the server. Additional Analyst Notes: - CVE Program Container: References: - http://blog.amossy
file to execute code on the server. Additional Analyst Notes: - CVE Program Container: References: - http://blog.amossys.fr/teampass-multiple-cve-01.html - https://github.com/nilsteampassnet/TeamPass/commit/9811c9d453da4bd1101ff7033250d1fbedf101fc
CVE ID: CVE-2017-15055 State: PUBLISHED Published: 2017-11-27T19:00:00 Last Updated: 2024-08-05T19:42:22.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments of an arbitrary item, copy the password of an arbitrary item to the copy/paste buffer, access the history of an arbitrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must
itrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must tamper with the requests sent directly, for example by changing the "item_id" parameter when invoking "copy_item" on items.queries.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.amossys.fr/teampass-multiple-cve-01.html - https://github.com/nilsteampassnet/TeamPass/commit/5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15f
CVE ID: CVE-2017-15056 State: PUBLISHED Published: 2017-10-06T07:00:00 Last Updated: 2024-08-05T19:42:22.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/upx/upx/issues/128
CVE ID: CVE-2017-15063 State: PUBLISHED Published: 2017-10-06T07:00:00 Last Updated: 2024-08-05T19:42:22.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query parameter to panel/database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/570 - https://github.com/intelliants/subrion/issues/547
CVE ID: CVE-2017-15064 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15065 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15066 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15067 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15068 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15069 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15070 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15071 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15072 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15073 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15074 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15075 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15076 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15077 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15078 State: REJECTED Published: 2017-10-06T17:00:00 Last Updated: 2017-10-10T18:57:01 Description: No description available.
CVE ID: CVE-2017-15079 State: PUBLISHED Published: 2017-10-06T18:00:00Z Last Updated: 2024-09-16T20:58:03.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-smushit/#developers - https://wordpress.org/support/topic/file-transversal-bug/
CVE ID: CVE-2017-15081 State: PUBLISHED Published: 2017-10-24T06:00:00 Last Updated: 2024-08-05T19:42:22.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/7Xjm8Wqt - http://w00troot.blogspot.in/2017/10/php-melody-2.html - https://www.exploit-db.com/exploits/43062/
CVE ID: CVE-2017-15083 State: REJECTED Published: 2017-10-11T18:00:00 Last Updated: 2017-10-11T17:57:02 Description: No description available.
CVE ID: CVE-2017-15084 State: PUBLISHED Published: 2017-10-06T21:00:00Z Last Updated: 2024-09-16T19:10:27.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/10/06/vulnerabilities-affecting-four-rapid7-products-fixed/
CVE ID: CVE-2017-15085 State: PUBLISHED Published: 2017-11-08T19:00:00Z Last Updated: 2024-08-05T19:42:22.382Z Vendors: Red Hat, Inc. Products: Gluster Storage for RHEL 6 Problem Types: CWE-300 Description: It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101554 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15085 - https://access.redhat.com/errata/RHSA-2017:3110
CVE ID: CVE-2017-15086 State: PUBLISHED Published: 2017-11-08T19:00:00Z Last Updated: 2024-08-05T19:42:22.359Z Vendors: Red Hat, Inc. Products: Gluster Storage for RHEL 6 Problem Types: CWE-300 Description: It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101555 - https://access.redhat.com/errata/RHSA-2017:3110 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15086
CVE ID: CVE-2017-15087 State: PUBLISHED Published: 2017-11-08T19:00:00Z Last Updated: 2024-08-05T19:42:22.324Z Vendors: Red Hat, Inc. Products: Gluster Storage for RHEL 6 Problem Types: CWE-200 Description: It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3110 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15087 - http://www.securityfocus.com/bid/101556
CVE ID: CVE-2017-15088 State: PUBLISHED Published: 2017-11-23T17:00:00 Last Updated: 2024-08-05T19:42:22.305Z Vendors: n/a Products: krb5 1.5 Problem Types: CWE-121 Description: plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plu
vance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1504045 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698 - https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4 - https://github.com/krb5/krb5/pull/707 - http://www.securityfocus.com/bid/101594
CVE ID: CVE-2017-15089 State: PUBLISHED Published: 2018-02-15T17:00:00Z Last Updated: 2024-09-16T19:05:25.998Z Vendors: Infinispan Products: infinispan Problem Types: CWE-502 Description: It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040360 - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - https://g
/1040360 - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - https://github.com/infinispan/infinispan/pull/5639 - https://access.redhat.com/errata/RHSA-2018:0294 - https://access.redhat.com/errata/RHSA-2018:0501 - https://access.redhat.com/errata/RHSA-2018:0480 - https://access.redhat.com/errata/RHSA-2018:0478 - https://access.redhat.com/errata/RHSA-2019:1326
CVE ID: CVE-2017-15090 State: PUBLISHED Published: 2018-01-23T15:00:00Z Last Updated: 2024-09-16T18:38:21.212Z Vendors: PowerDNS Products: PowerDNS Problem Types: CWE-347 Description: An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records. Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/recursor/security-advisories/p
Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-03.html - http://www.securityfocus.com/bid/101982
CVE ID: CVE-2017-15091 State: PUBLISHED Published: 2018-01-23T15:00:00Z Last Updated: 2024-08-05T19:50:14.942Z Vendors: PowerDNS Products: PowerDNS Authoritative Problem Types: CWE-863 Description: An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. This missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or send a NOTIFY. Additional Analyst Notes: - CVE Program Container: References: - htt
he cache, trigger a zone transfer or send a NOTIFY. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101982 - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2017-04.html
CVE ID: CVE-2017-15092 State: PUBLISHED Published: 2018-01-23T15:00:00Z Last Updated: 2024-09-17T03:27:42.169Z Vendors: PowerDNS Products: PowerDNS Recursor Problem Types: CWE-79 Description: A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101982 - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-05.html
CVE ID: CVE-2017-15093 State: PUBLISHED Published: 2018-01-23T15:00:00Z Last Updated: 2024-09-17T00:35:38.803Z Vendors: PowerDNS Products: PowerDNS Recursor Problem Types: CWE-20 Description: When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.
ntly validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101982 - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-06.html
CVE ID: CVE-2017-15094 State: PUBLISHED Published: 2018-01-23T15:00:00Z Last Updated: 2024-09-16T16:48:39.753Z Vendors: PowerDNS Products: PowerDNS Recursor Problem Types: CWE-401 Description: An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default). Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-07.html - http://www.securityfocus.com/bid/101982
CVE ID: CVE-2017-15095 State: PUBLISHED Published: 2018-02-06T15:00:00Z Last Updated: 2024-09-16T22:57:07.488Z Vendors: FasterXML Products: jackson-databind Problem Types: CWE-184 Description: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1448 - http://www.securityfocus.co