Input Validation and Logic

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by s…CVE-2017-7525FasterXML · 38% likely

   CWE-184

2. FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-…CVE-2018-7489Fasterxml · 20% likely

   CWE-184

3. A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending t…CVE-2017-15095FasterXML · 8.4% likely

   CWE-184

4. FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-1748…CVE-2018-5968Fasterxml · 7.2% likely

   CWE-184

5. Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). Thi…CVE-2018-1000873Fasterxml · 4.8% likely

   CWE-20

6. jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513FasterXML · CVSS 8.1 · 1.2% likely

   CWE-184

7. jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationCVE-2026-54512FasterXML · CVSS 8.1 · 1.1% likelycovered by CyberSIXT

   CWE-1841 article

8. DOS in jackson-dataformats-textCVE-2023-3894FasterXML · CVSS 5.8 · 0.9% likely

   CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.