Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Alibaba Component: Fastjson Clear all filters
TI-2022-09412 CVE-2022-25845 · GHSA-pv7h-hx5h-mgfj

Deserialization of untrusted data in com.alibaba:fastjson

Priority MEDIUM 60

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18743 Published 2022-06-10 Partial fix · 1.2.83 CWE-502
TI-2017-13524 CVE-2017-18349 · GHSA-xjrr-xv9m-4pw5

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and…

Priority HIGH 69

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI i…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.38843 Published 2018-10-23 Fixed in 1.2.31, 1.12.0 CWE-20