NVD disclosure day

Published threat advisories for September 15, 2019

CVE-2019-16335

FasterXML Jackson Databind Polymorphic Typing Vulnerability.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A polymorphic typing vulnerability in FasterXML jackson-databind may allow remote code execution via crafted JSON input related to HikariDataSource. The broad use of this library in processing JSON data creates a significant potential attack surface.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2019-14540

FasterXML Jackson Polymorphic Typing Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A polymorphic typing issue in FasterXML jackson-databind allows for remote code execution when processing untrusted data. This critical vulnerability, due to the library's widespread use, could lead to system compromise if reachable via the network.

NVD modified: NVD date unavailable