Skip to content
fr Sign in
8.8 High

CVE-2020-36184 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing,…

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Affected products and versions

Product Affected versions Fixed in
n/a Versions not published
jackson-databind 2.9 earliest → < 2.9.10.8 2.9.10.8
debian_linux 8.0 No fix stated
steelstore_cloud_integrated_storage Versions not published
agile_plm 9.3.6 No fix stated
autovue_for_agile_product_lifecycle_management 21.0.2 No fix stated
banking_digital_experience 20.1 No fix stated
banking_digital_experience 19.1 19.1 → 19.2 No fix stated
banking_digital_experience 18.1 18.1 → 18.3 No fix stated
Show the 29 other branches
Product Affected versions Fixed in
banking_digital_experience 2.4 2.4.0 → 2.9.0 No fix stated
communications_calendar_server 8.0 8.0.0.4.0 → 8.0.0.5.0 No fix stated
communications_diameter_signaling_router 8.0 8.0.0 → 8.2.2 No fix stated
communications_element_manager 8.2 8.2.0 → 8.2.2 No fix stated
communications_evolved_communications_application_server 7.1 No fix stated
communications_instant_messaging_server 10.0.1.4.0 No fix stated
communications_network_charging_and_control 12.0 12.0.0 → 12.0.3 No fix stated
communications_session_route_manager 8.2 8.2.0 → 8.2.2 No fix stated
enterprise_manager_base_platform 13.3 13.3.0.0 → 13.4.0.0 No fix stated
financial_services_analytical_applications_infrastructure 8.0 8.0.6 → 8.1.0 No fix stated
financial_services_institutional_performance_analytics 8.1.0 No fix stated
financial_services_institutional_performance_analytics 8.0 8.0.6 → 8.0.7 No fix stated
financial_services_price_creation_and_discovery 8.0 8.0.6 → 8.0.7 No fix stated
financial_services_retail_customer_analytics 8.0.6 No fix stated
global_lifecycle_management_opatch 12.2 earliest → 12.2.0.1.20 No fix stated
insurance_policy_administration_j2ee 11.0 11.0.2.25 → < 11.1.0.15 11.1.0.15
jd_edwards_enterpriseone_orchestrator 9.2 earliest → 9.2.4.2 No fix stated
primavera_unifier 19.12 No fix stated
primavera_unifier 18.8 No fix stated
primavera_unifier 17.7 17.7 → 17.12 No fix stated
primavera_unifier 16.2 No fix stated
primavera_unifier 16.1 No fix stated
retail_merchandising_system 15.0 No fix stated
retail_sales_audit 14.1 No fix stated
retail_service_backbone 16.0 No fix stated
retail_service_backbone 15.0 No fix stated
retail_service_backbone 14.1 No fix stated
retail_xstore_point_of_service 15.0 15.0 → 19.0 No fix stated
weblogic_server 12.2 12.2.1.3.0 → 12.2.1.4.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of n/a

The 144658 CVEs of n/a →
CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated
Track this CVE