71 matches found
TRAI-001-Critical-RCE-Vulnerability-in-Apache-Parquet-CVE-2025-30065-Simulation
TRAI-001 CVE-2025-30065: Apache Parquet Remote Code Execution RCE Exploit Simulator Demo Screenshot Simulator interface demonstrating the exploit chain 📌 Overview This repository contains an educational simulation of CVE-2025-30065, a critical Remote Code Execution vulnerability in Apache Parquet...
CVE-2025-30065
CVE-2025-30065 研究笔记 此仓库刻意保持小巧且可读性高。它旨在用于对 Apache Parquet / Avro 模式处理中的 CVE-2025-30065 进行授权安全研究、本地验证和防御性研究。 本 README 侧重于仓库卫生、构建可复现性和安全使用。它不提供可操作的漏洞利用指导。 仓库内容 一个基于 Java 的研究框架。 一组用于在受控实验室中研究此漏洞的少量源文件。 一个 Maven 构建定义。 一个辅助脚本，用于在本地编译和运行项目。 前提条件 Java 8 或更新版本。 Maven。 一个您拥有或得到明确授权使用的受控测试环境。 构建和运行...
parquet-canary-exploit-rce-poc-CVE-2025-30065
Parquet CVE-2025-30065 的 Canary 漏洞利用 root@kitploit: -. '-. OO OO .-----,--/ ,. ,------. .-----. .----. .-----..------. .-----. .----. .----. ,--. .------. ' .--.\ \ //| .---' .-'/ ,-. / .. / ,-. | | .-' / -. / .. \ / .. \ / .' | | | |'-.\ \ / / | | OO'-' | . / \ '-' | | '--. OO'-' ' . / \ . / ...
parquet-rce-poc-CVE-2025-30065
CVE-2025-30065 本仓库演示了如何利用 CVE-2025-30065 实现远程类实例化，并在受害者应用程序（即 JVM）内部触发网络请求，从而实现 SSRF。 Malicious.java 生成的 parquet 文件假定类 RCEPayload.java 已存在于类路径中，但这并不现实。你可以通过执行 Reader.java 来触发该 PoC。 MaliciousSSRF.java 从攻击者的角度来看更为可行，它会触发一个网络连接，该连接可以是内网或外网的。 还可以寻找其他 gadget 来实现 RCE（难点在于找到一个接受字符串作为参数并导向 RCE 的指令，这不像普通的...
CVE-2025-30065-PoC
CVE-2025-30065 PoC Verwendung Image erstellen root@kitploit: docker build -t cve-2025-30065 . Bösartiges Parquet generieren root@kitploit: docker run --rm -v $pwd:/poc/out cve-2025-30065 generate "cat /etc/passwd" ./out/malicious.parquet Exploit auslösen root@kitploit: docker run --rm -v...
Security Bulletin: Due to the use of IBM Tivoli Monitoring and IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities
Summary IBM Tivoli Monitoring code execution and IBM Db2 vulnerabilities have been found in IBM Tivoli Monitoring shipped with IBM Cloud Pak System IBM Tivoli MonitoringITM patternType itm pType, and IBM Cloud Pak System DB2 pattern type db2 pType shipped with Cloud Pak System. Vulnerabilities we...
EUVD-2025-30065
Malicious code in bioql PyPI...
Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in Apache Parquet (CVE-2025-30065).
Summary Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.15.1, which fixes the issue. Note: A Db2 server is not vulnerable to CVE-2025-30065 if the database manager...
Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to tampering and elevation of privilege (CVE-2025-30065) due to the use of IBM Db2
Summary IBM Virtualization Engine TS7700 is susceptible to a tampering and privilege escalation vulnerability CVE-2025-30065, due to the use of IBM Db2, which is primarily embedded to store metadata related to the data it manages. Additionally, this patch also includes updates for other...
Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera
Summary On April 1, 2025, a critical vulnerability in the parquet-avro module of Apache Parquet CVE-2025-30065, CVSS score 10.0 was announced. Vulnerability Details CVEID:CVE-2025-30065 DESCRIPTION: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows ba...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
CVE-2025-30065 == Dangerous Deserialization in Parquet-Avro 🔥...
K000152311: Busybox vulnerabilities CVE-2022-28391 and CVE-2022-30065
Security Advisory Description CVE-2022-28391 BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors. CVE-2022-30065 A...
Security Bulletin: Apache Parquet vulnerabilities affect watsonx.data
Summary Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code and this could affect watsonx.data. Vulnerability Details CVEID:CVE-2025-30065 DESCRIPTION: Schema parsing in the parquet-avro module of Apache Parquet 1.15...
CVE-2021-30065
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
Canary Exploit for Parquet CVE-2025-30065...
Apache Parquet 2.9.0 Remote Code Execution
Apache Parquet versions 2.9.0 and below educational simulation of CVE-2025-30065, a critical remote code execution vulnerability in Apache Parquet files. The tool demonstrates how attackers exploit this flaw to gain full system control, while providing mitigation guidance...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
TRAI-001 CVE-2025-30065: Apache Parquet Remote Code Execution...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
TRAI-001 CVE-2025-30065: Apache Parquet Remote Code Execution...
Apache Parquet < 1.15.1 Remote Code Execution (CVE-2025-30065)
The version of Apache Parquet on the remote host is prior to 1.15.1. It is, therefore, affected by a remote code execution vulnerability: - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to...