snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC ビルド ホスト上で mvn clean compile assembly:single を使って jar をビルドするか、 または docker を使用して docker build -t snakeyaml . でイメージをビルドします。 実行 コンテナを docker run --rm -p8080:8080 snakeyaml で実行するか、 ホスト上でビルドした jar を java -jar...

CVE-2022-1471-attacker

此存储库没有 README。...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC Veracodeブログ用のコード コード実行を実証するには、以下の手順に従ってください。 1. Mavenを使用してプロジェクトをビルドします。 2. python3 -m http.server 8080 を実行してHTTPサーバーを起動します。 3. exploit.java を実行します。サーバー上でHTTP GETリクエストが確認できるはずです。 4. SnakeYAML 2.0が攻撃を防止する方法を実証するには、pom.xml内の1.33依存関係をコメントアウトします。 5...

seans-surf-and-skate

Sean's Surf & Skate Co. — Demostración de Seal Security Maven / Java Una pequeña pero realista tienda de comercio electrónico "Sean's Surf & Skate Co." construida con Spring Boot. Viene con dependencias de código abierto con vulnerabilidades conocidas para que pueda usarse para demostrar cómo Sea...

yaml-payload

yaml-payload SnakeYAMLの安全でないYaml.loadを介して読み込まれると、このペイロードは実行中のアプリケーションを乗っ取り 、「You've Been PWNED」ページに置き換えます。 1. Tomcat Valveを注入 し、リフレクションを介して実行中のSpring Bootアプリに侵入し、既存のポート8080を乗っ取ります — 同じURL（ngrokトンネルを含む）がPWNEDページを提供するようになります。 2. ブラウザを自動リダイレクト —...

cve-2022-1471-jira-lab

CVE-2022-1471 — Lab RCE SnakeYAML contesto Jira / Automation for Jira Lab offline e autonomo che dimostra il meccanismo alla base di CVE-2022-1471 deserializzazione non sicura SnakeYAML → RCE, CVSS 9.8, come sfruttato nel finding su Jira / Jira Service Management contro un host con 9.4.9 range...

yaml-payload

yaml-payload Un payload di deserializzazione SnakeYAML per CVE-2022-1471 , adattato da artsploit/yaml-payload basato originariamente su mbechler/marshalsec. Cosa fa Quando caricato tramite l'uso non sicuro di Yaml.load di SnakeYAML, questo payload prende il controllo dell'applicazione in esecuzio...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

CVE-2022-1471 — SnakeYAML RCE lab Jira / Automation for Jira...

ROOT-APP-MAVEN-CVE-2022-1471 CVE-2022-1471 in io.root.org.yaml:snakeyaml - Patched by Root

Root has patched CVE-2022-1471 in the io.root.org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-MM56295 Security fixes in spark-sc212-jdk17-py311 3.4.4-r0

Package spark-sc212-jdk17-py311 version 3.4.4-r0 fixes 45 vulnerabilities: ghsa-mjmj-j48q-9wg2, CVE-2022-1471, ghsa-r7pg-v2c8-mfg3, CVE-2024-47561, CVE-2023-39410...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload A SnakeYAML deserialization exploit payload for...

Exploit for Improper Input Validation in Snakeyaml_Project Snakeyaml

Seal Security — Java Maven Example A minimal, intentionally...

RCE (Remote Code Execution) org.yaml:snakeyaml Dependency in Confluence Data Center

This Confluence release includes updates to our org.yaml:snakeyaml dependency in response to CVE-2022-1471. Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility (CVE-2025-1470, CVE-2025-1471)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 11 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-1470 DESCRIPTION: In...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload Exploit payload JAR for demonstrating CVE-2022-...

RHEL 8 : thunderbird (RHSA-2026:1471)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:1471 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: Spoofing issue in the Downloads Panel component...

CVE-2025-1471

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized...

Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management Core Framework.

Summary Multiple vulnerabilities were addressed in IBM Application Performance Management 8.1.4.0 Core Framework IF29 patch. Vulnerability Details CVEID:CVE-2025-1470 DESCRIPTION: In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumer...

HPESBNW04940 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 5.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-47621 |...