hot-jar-swapping-urlclassloader

Intercambio en caliente de JAR con URLClassLoader El siguiente código de ejemplo demuestra la capacidad de intercambiar en caliente un JAR ya cargado y obtener ejecución de código abusando del hecho de que las clases internas todavía acceden al archivo JAR cuando se invocan, siempre y cuando el...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

semgrep-rules

semgrep-rules "The attack surface is the vulnerability. Finding a bug there is just a detail." -- Mark Dowd "Some details are more important than others." -- Fedor G. Pikus A collection of my Semgrep rules to facilitate vulnerability research. Blog posts...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

splinter

splinter splinter es un kit de herramientas de análisis de la JVM, que permite al usuario ver clases, métodos, campos, conjuntos constantes y bytecode en tiempo de ejecución. Esto fue creado y probado en OpenJDK compilación 22.0.2+9-70 ¿Qué es splinter? Normalmente, cuando uno piensa en un kit de...

kaiju

CERT Kaiju Binary Analysis Framework for GHIDRA CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Frameworkpharos, particularly the function hashing and malware analysis tools, but is expected t...

CVE-2025-24813

Probando cualquier versión de Tomcat para ver si esa versión es vulnerable a CVE-2025-24813 Este POC permite probar cualquier versión de Tomcat para verificar si esa versión es vulnerable a CVE-2025-24813 bajo las condiciones vulnerables, en entornos Unix probado en una máquina Ubuntu. Nota:...

log4shell-vulnerable-app

Aplicación vulnerable Este repositorio contiene una aplicación web Spring Boot vulnerable a CVE-2021-44228, conocida como log4shell. Usa log-4j-core:2.14.1 a través de spring-boot-starter-log4j2 y openjdk:8u181 Ejecutando la aplicación Ejecútalo: docker run --name vulnerable-app --rm -p 8080:8080...

Rocky Linux 8.8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_1078)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261078 advisory. This advisory aggregates security fixes for the java-17-openjdk SRPM in CIQ LTS 8.8. It addresses 6 CVEs: CVE-2024-20918, CVE-2024-20921, CVE-2024-20945,...

Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2022_5696)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225696 advisory. OpenJDK: integer truncation issue in Xalan-J JAXP, 8285407 CVE-2022-34169 OpenJDK: class compilation issue Hotspot, 8281859 CVE-2022-21540 OpenJDK: imprope...

Rocky Linux 9.6 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1770116781)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770116781 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster ima...

Rocky Linux 8.6 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_1253)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261253 advisory. This advisory aggregates security fixes for the java-11-openjdk SRPM in CIQ LTS 8.6. It addresses 16 CVEs: CVE-2024-20918, CVE-2024-20921, CVE-2024-20945...

Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_5726)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225726 advisory. OpenJDK: integer truncation issue in Xalan-J JAXP, 8285407 CVE-2022-34169 OpenJDK: class compilation issue Hotspot, 8281859 CVE-2022-21540 OpenJDK: imprope...

Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2022_1491)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221491 advisory. OpenJDK: Defective secure validation in Apache Santuario Libraries, 8278008 CVE-2022-21476 OpenJDK: Unbounded memory allocation when compiling crafted XPat...

AlmaLinux 9.2 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752246531)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752246531 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affecte...

CentOS Linux 7.9 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debug / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0680)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260680 advisory. This advisory aggregates security fixes for the java-11-openjdk SRPM in CIQ CentOS Bridge 7.9. It addresses 11 CVEs: CVE-2022-42252, CVE-2024-21131,...

AlmaLinux 9.6 [TuxCare] Security Update: java-21-openjdk / java-21-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1771408532)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771408532 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image...

Rocky Linux 9 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_7013)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227013 advisory. OpenJDK: improper MultiByte conversion can lead to buffer overflow JGSS, 8286077 CVE-2022-21618 OpenJDK: excessive memory allocation in X.509 certificate...

Rocky Linux 9.2 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0435)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260435 advisory. This advisory aggregates security fixes for the java-11-openjdk SRPM in CIQ LTS 9.2. It addresses 16 CVEs: CVE-2024-21011, CVE-2024-21131, CVE-2024-21085...

CentOS Linux 7.9 [CIQ] Security Update: java-1.7.0-openjdk / java-1.7.0-openjdk-accessibility / etc (ciqsa-2026_0682)

The CentOS Linux 7.9 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260682 advisory. This advisory aggregates security fixes for the java-1.7.0-openjdk SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2022-21476. Tenable has extracted the...