cve-2021-21985_exp

cve-2021-21985 exploit 0x01 Vulnerability Point Analysis available at: https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985?referrer=homerapid7-analysis 0x02 exploit Reconstruct the beans object to achieve RCE. Bean list: localizedMessageBundle vsanWorkerThreadFactory vsanThreadPoolImpl...

ROOT-APP-MAVEN-CVE-2022-22970 CVE-2022-22970 in org.springframework:spring-beans - Patched by Root

Root has patched CVE-2022-22970 in the org.springframework:spring-beans package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-22965 CVE-2022-22965 in org.springframework:spring-beans - Patched by Root

Root has patched CVE-2022-22965 in the org.springframework:spring-beans package for Root:Maven. Multiple fixed versions available...

jsonorg-tp1

json.org CVE-2022-45688 true positive The project illustrates CVE-2022-45688 in json.org -- there is a simple application XML2JSONConverter to read XML from input, convert it to JSON and pretty-print it to the console. Using malicious input, the application crashes with a stackoverflow. The test...

EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, Spring Beans and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring...

CVE-2026-55223 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

CVE-2026-42588 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy...

MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.5-2.2.1.AXS4 (AXSA:2012-909:02)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-909:02 advisory. The OpenJDK runtime environment. Security issues fixed with this release: CVE-2012-0547 Unspecified vulnerability in the Java Runtime Environment JRE...

ysoserial

ysoserial !GitHub releasehttps://img.shields.io/github/do...

Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-beans-6.2.3.jar (CVE-2025-41242)

Summary IBM Sterling Connect:Direct Web Services is vulnerable toPath Traversal Vulnerability in spring-beans-6.2.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a...

EUVD-2013-5626

Malware in sbrugna...

EUVD-2009-2086

Malware in sbrugna...

EUVD-2013-0455

Malware in sbrugna...

EUVD-2012-4477

Malware in sbrugna...

EUVD-2025-11528

Malicious code in bioql PyPI...

EUVD-2022-5420

Malicious code in bioql PyPI...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...