jersey-media-json-jackson-2.27.jar: 28 vulnerabilities (highest severity is: 9.8)

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - jersey-media-json-jackson-2.27.jar</summary>


Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml



Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a></details>

## Vulnerabilities

| Vulnerability | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Dependency | Type | Fixed in (jersey-media-json-jackson version) | Remediation Possible** |
| ------------- | ------------- | ----- | ----- | ----- | ------------- | --- |
| [CVE-2019-20330](https://www.mend.io/vulnerability-database/CVE-2019-20330) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2019-17267](https://www.mend.io/vulnerability-database/CVE-2019-17267) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2019-16943](https://www.mend.io/vulnerability-database/CVE-2019-16943) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2019-16942](https://www.mend.io/vulnerability-database/CVE-2019-16942) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2019-14892](https://www.mend.io/vulnerability-database/CVE-2019-14892) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2019-14540](https://www.mend.io/vulnerability-database/CVE-2019-14540) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2019-10202](https://www.mend.io/vulnerability-database/CVE-2019-10202) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.29 | &#9989; |
| [CVE-2018-19360](https://www.mend.io/vulnerability-database/CVE-2018-19360) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2017-15095](https://www.mend.io/vulnerability-database/CVE-2017-15095) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | jackson-databind-2.8.10.jar | Transitive | N/A* | &#10060; |
| [CVE-2020-11113](https://www.mend.io/vulnerability-database/CVE-2020-11113) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-11112](https://www.mend.io/vulnerability-database/CVE-2020-11112) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-11111](https://www.mend.io/vulnerability-database/CVE-2020-11111) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-10969](https://www.mend.io/vulnerability-database/CVE-2020-10969) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-10968](https://www.mend.io/vulnerability-database/CVE-2020-10968) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-10673](https://www.mend.io/vulnerability-database/CVE-2020-10673) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-10672](https://www.mend.io/vulnerability-database/CVE-2020-10672) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.8 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-14195](https://www.mend.io/vulnerability-database/CVE-2020-14195) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2020-14062](https://www.mend.io/vulnerability-database/CVE-2020-14062) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2020-14061](https://www.mend.io/vulnerability-database/CVE-2020-14061) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2020-14060](https://www.mend.io/vulnerability-database/CVE-2020-14060) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.28 | &#9989; |
| [CVE-2020-11620](https://www.mend.io/vulnerability-database/CVE-2020-11620) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-11619](https://www.mend.io/vulnerability-database/CVE-2020-11619) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [CVE-2020-10650](https://www.mend.io/vulnerability-database/CVE-2020-10650) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | jackson-databind-2.8.10.jar | Transitive | 2.30.1 | &#9989; |
| [WS-2022-0468](https://github.com/FasterXML/jackson-core/issues/861) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-core-2.8.10.jar | Transitive | 2.41 | &#9989; |
| [CVE-2025-52999](https://www.mend.io/vulnerability-database/CVE-2025-52999) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-core-2.8.10.jar | Transitive | 2.41 | &#9989; |
| [CVE-2022-42004](https://www.mend.io/vulnerability-database/CVE-2022-42004) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.8.10.jar | Transitive | 2.36 | &#9989; |
| [CVE-2022-42003](https://www.mend.io/vulnerability-database/CVE-2022-42003) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.8.10.jar | Transitive | 2.36 | &#9989; |
| [CVE-2025-49128](https://www.mend.io/vulnerability-database/CVE-2025-49128) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.0 | jackson-core-2.8.10.jar | Transitive | N/A* | &#10060; |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details


> Partial details (25 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application. 

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-20330</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-03
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-20330>CVE-2019-20330</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2020-01-03
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.5
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-17267</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-06
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-17267>CVE-2019-17267</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2019-10-06
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.5
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-16943</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-16943>CVE-2019-16943</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://osv.dev/vulnerability/GHSA-fmmc-742q-jg75">https://osv.dev/vulnerability/GHSA-fmmc-742q-jg75</a>
Release Date: 2019-10-01
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.5
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-16942</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-16942>CVE-2019-16942</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://osv.dev/vulnerability/GHSA-mx7p-6679-8g3q">https://osv.dev/vulnerability/GHSA-mx7p-6679-8g3q</a>
Release Date: 2019-10-01
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.5
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-14892</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Publish Date: 2020-03-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-14892>CVE-2019-14892</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://osv.dev/vulnerability/GHSA-cf6r-3wgc-h863">https://osv.dev/vulnerability/GHSA-cf6r-3wgc-h863</a>
Release Date: 2020-03-02
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.5
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-14540</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-14540>CVE-2019-14540</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://osv.dev/vulnerability/GHSA-h822-r4r5-v8jg">https://osv.dev/vulnerability/GHSA-h822-r4r5-v8jg</a>
Release Date: 2019-09-15
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.5
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-10202</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Publish Date: 2019-10-01
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-10202>CVE-2019-10202</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://lists.apache.org/thread/08302h5kp2l9ry2zq8vydomlhn0fg4j4">https://lists.apache.org/thread/08302h5kp2l9ry2zq8vydomlhn0fg4j4</a>
Release Date: 2019-10-01
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.9
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.29






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2018-19360</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Publish Date: 2019-01-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2018-19360>CVE-2018-19360</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://osv.dev/vulnerability/GHSA-f9hv-mg5h-xcw9">https://osv.dev/vulnerability/GHSA-f9hv-mg5h-xcw9</a>
Release Date: 2019-01-02
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.3
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2017-15095</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Publish Date: 2018-02-06
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2017-15095>CVE-2017-15095</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-15095">https://nvd.nist.gov/vuln/detail/CVE-2017-15095</a>
Release Date: 2018-02-06
Fix Resolution: 2.8.10,2.9.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-11113</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Publish Date: 2020-03-31
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-11113>CVE-2020-11113</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113</a>
Release Date: 2020-03-31
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-11112</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Publish Date: 2020-03-31
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-11112>CVE-2020-11112</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11112">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11112</a>
Release Date: 2020-03-31
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-11111</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Publish Date: 2020-03-31
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-11111>CVE-2020-11111</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113</a>
Release Date: 2020-03-31
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-10969</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Publish Date: 2020-03-26
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-10969>CVE-2020-10969</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969</a>
Release Date: 2020-03-26
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-10968</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Publish Date: 2020-03-26
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-10968>CVE-2020-10968</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-10968">https://nvd.nist.gov/vuln/detail/CVE-2020-10968</a>
Release Date: 2020-03-26
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-10673</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Publish Date: 2020-03-18
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-10673>CVE-2020-10673</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2020-03-18
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-10672</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Publish Date: 2020-03-18
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-10672>CVE-2020-10672</a>




### CVSS 3 Score Details (8.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-10672">https://nvd.nist.gov/vuln/detail/CVE-2020-10672</a>
Release Date: 2020-03-18
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-14195</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Publish Date: 2020-06-16
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-14195>CVE-2020-14195</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14195">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14195</a>
Release Date: 2020-06-16
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.6
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-14062</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Publish Date: 2020-06-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-14062>CVE-2020-14062</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14062">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14062</a>
Release Date: 2020-06-14
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.6
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-14061</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Publish Date: 2020-06-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-14061>CVE-2020-14061</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14061">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14061</a>
Release Date: 2020-06-14
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.6
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-14060</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Publish Date: 2020-06-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-14060>CVE-2020-14060</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14060">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14060</a>
Release Date: 2020-06-14
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.8.11.6
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.28






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-11620</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Publish Date: 2020-04-07
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-11620>CVE-2020-11620</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11620">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11620</a>
Release Date: 2020-04-07
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-11619</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Publish Date: 2020-04-07
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-11619>CVE-2020-11619</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11619">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11619</a>
Release Date: 2020-04-07
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-10650</summary>


### Vulnerable Library - jackson-databind-2.8.10.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - :x: **jackson-databind-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Publish Date: 2022-12-26
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-10650>CVE-2020-10650</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-rpr3-cw39-3pxh">https://github.com/advisories/GHSA-rpr3-cw39-3pxh</a>
Release Date: 2022-12-26
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.9.10.4
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.30.1






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2022-0468</summary>


### Vulnerable Library - jackson-core-2.8.10.jar

Core Jackson abstractions, basic JSON streaming API implementation
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - jackson-databind-2.8.10.jar
 - :x: **jackson-core-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
The jackson-core package is vulnerable to a Denial of Service (DoS) attack. The methods in the classes listed below fail to restrict input size when performing numeric type conversions. A remote attacker can exploit this vulnerability by causing the application to deserialize data containing certain numeric types with large values. Deserializing many of the aforementioned objects may cause the application to exhaust all available resources, resulting in a DoS condition.

Publish Date: 2022-12-07
URL: <a href=https://github.com/FasterXML/jackson-core/issues/861>WS-2022-0468</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-12-07
Fix Resolution (com.fasterxml.jackson.core:jackson-core): 2.15.0-rc1
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.41






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2025-52999</summary>


### Vulnerable Library - jackson-core-2.8.10.jar

Core Jackson abstractions, basic JSON streaming API implementation
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /pom.xml
Path to vulnerable library: /pom.xml


Dependency Hierarchy:
 - jersey-media-json-jackson-2.27.jar (Root Library)
 - jackson-databind-2.8.10.jar
 - :x: **jackson-core-2.8.10.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/SharonKoch/Traccar-unsafe_Demo/commit/60011ae7663cd65acf66505fdbadc815033eace6">60011ae7663cd65acf66505fdbadc815033eace6</a>
Found in base branch: main




### Vulnerability Details
 
 
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

Publish Date: 2025-06-25
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2025-52999>CVE-2025-52999</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2025-06-25
Fix Resolution (com.fasterxml.jackson.core:jackson-core): 2.15.0
Direct dependency fix Resolution (org.glassfish.jersey.media:jersey-media-json-jackson): 2.41






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details>

***

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (jersey-media-json-jackson version)	Remediation Possible**
CVE-2019-20330	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2019-17267	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2019-16943	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2019-16942	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2019-14892	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2019-14540	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2019-10202	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.29	✅
CVE-2018-19360	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2017-15095	Critical	9.8	jackson-databind-2.8.10.jar	Transitive	N/A*	❌
CVE-2020-11113	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-11112	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-11111	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-10969	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-10968	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-10673	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-10672	High	8.8	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-14195	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2020-14062	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2020-14061	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2020-14060	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.28	✅
CVE-2020-11620	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-11619	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
CVE-2020-10650	High	8.1	jackson-databind-2.8.10.jar	Transitive	2.30.1	✅
WS-2022-0468	High	7.5	jackson-core-2.8.10.jar	Transitive	2.41	✅
CVE-2025-52999	High	7.5	jackson-core-2.8.10.jar	Transitive	2.41	✅
CVE-2022-42004	High	7.5	jackson-databind-2.8.10.jar	Transitive	2.36	✅
CVE-2022-42003	High	7.5	jackson-databind-2.8.10.jar	Transitive	2.36	✅
CVE-2025-49128	Medium	4.0	jackson-core-2.8.10.jar	Transitive	N/A*	❌

jersey-media-json-jackson-2.27.jar: 28 vulnerabilities (highest severity is: 9.8) #6

Description

Vulnerabilities

Details

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.8)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.1)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.1)

Suggested Fix

Vulnerable Library - jackson-databind-2.8.10.jar

Vulnerability Details

CVSS 3 Score Details (8.1)

Suggested Fix