Read the docs

Alibaba

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Alibaba records in CISA KEV

No Alibaba vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nacos 5 records HIGH Fastjson 2 records HIGH Alibaba 1 record LOW Alipay Activex Control 1 record LOW Druid 1 record LOW Tengine 1 record MEDIUM

Records

2 records in Fastjson · all components

TI-2017-13524 CVE-2017-18349 · GHSA-xjrr-xv9m-4pw5

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and…

Priority HIGH 69

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI i…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.38843 Published 2018-10-23 Fixed in 1.2.31, 1.12.0 CWE-20
TI-2022-09412 CVE-2022-25845 · GHSA-pv7h-hx5h-mgfj

Deserialization of untrusted data in com.alibaba:fastjson

Priority MEDIUM 60

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18743 Published 2022-06-10 Partial fix · 1.2.83 CWE-502
Open these records in search →