snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC build Either build the jar on your host with mvn clean compile assembly:single Or use docker to build an image with docker build -t snakeyaml . run Run the container with docker run --rm -p8080:8080 snakeyaml or the jar if you built on your host with ja...

CVE-2022-1471-attacker

This repository does not have a README...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC Code for veracode blog To demonstrate the Code Execution, 1. Build the project using maven 2. Execute python3 -m http.server 8080 to run the http server 3. Run exploit.java. You should observe a HTTP GET request on the server 4. To demonstrate how SnakeYAML 2.0 prevent...

yaml-payload

yaml-payload Эксплойт-пейлоад для десериализации SnakeYAML для CVE-2022-1471 , адаптированный из artsploit/yaml-payload изначально основан на mbechler/marshalsec. Что он делает При загрузке через небезопасный Yaml.load в SnakeYAML этот пейлоад перехватывает управление запущенным приложением и...

cve-2022-1471-jira-lab

CVE-2022-1471 — лаборатория SnakeYAML RCE контекст Jira / Automation for Jira Автономная самодостаточная лаборатория, демонстрирующая механизм CVE-2022-1471 небезопасная десериализация SnakeYAML → RCE, CVSS 9.8, используемый в находке Jira / Jira Service Management против хоста под управлением...

Rocky Linux 8.6 [CIQ] Security Update: prometheus-jmx-exporter / prometheus-jmx-exporter-openjdk11 / etc (ciqsa-2026_0151)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260151 advisory. This advisory aggregates security fixes for the prometheus-jmx-exporter SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-1471. Tenable has extracted the precedin...

ROOT-APP-MAVEN-CVE-2022-1471 CVE-2022-1471 in org.yaml:snakeyaml - Patched by Root

Root has patched CVE-2022-1471 in the org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available...

seans-surf-and-skate

Sean's Surf & Skate Co. — सील सिक्योरिटी डेमो Maven / Java स्प्रिंग बूट के साथ बनाया गया एक छोटा लेकिन वास्तविक दिखने वाला ई-कॉमर्स स्टोरफ्रंट "Sean's Surf & Skate Co."। यह ज्ञात कमज़ोरियों वाली ओपन-सोर्स डिपेंडेंसियों के साथ आता है ताकि इसका उपयोग यह प्रदर्शित करने के लिए किया जा सके कि Seal...

seans-surf-and-skate

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A small but real-looking e-commerce storefront "Sean's Surf & Skate Co." built with Spring Boot. It ships with known-vulnerable open-source dependencies so it can be used to demonstrate how Seal Security remediates CVEs with backported...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

CVE-2022-1471 — SnakeYAML RCE lab Jira / Automation for Jira...

CLEANSTART-2026-MM56295 Security fixes in spark-sc212-jdk17-py311 3.4.4-r0

Package spark-sc212-jdk17-py311 version 3.4.4-r0 fixes 45 vulnerabilities: ghsa-mjmj-j48q-9wg2, CVE-2022-1471, ghsa-r7pg-v2c8-mfg3, CVE-2024-47561, CVE-2023-39410...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload A SnakeYAML deserialization exploit payload for...

RCE (Remote Code Execution) org.yaml:snakeyaml Dependency in Confluence Data Center

This Confluence release includes updates to our org.yaml:snakeyaml dependency in response to CVE-2022-1471. Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload Exploit payload JAR for demonstrating CVE-2022-...

HPESBNW04940 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 5.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-47621 |...

Security Bulletin: IBM UrbanCode Build 6.1.7.10 addresses multiple vulnerabilities.

Summary Security Bulletin: IBM UrbanCode Build 6.1.7.10 addresses multiple vulnerabilities, listed in multiple CVEs CVE-2023-34981, CVE-2022-1471, CVE-2022-4065, CVE-2021-23450, CVE-2021-23450, CVE-2022-40151, CVE-2022-41966, CVE-2023-41080, CVE-2022-48285, CBE-2020-11971, CVE-2023-28709,...

Security Bulletin: IBM Sterling Global High Availability Mailbox is affected by a SnakeYaml deserialization vulnerability (CVE-2022-1471)

Summary IBM Sterling Global High Availability Mailbox is affected by SnakeYaml's Constructor class it does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's...

RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3198 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

RHEL 8 : OpenShift Container Platform 4.10.52 (RHSA-2023:0697)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0697 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...