6 matches found
CVE-2023-34040
CVE-2023-34040 Questa PoC ĆØ un clone di https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 Per il nostro processo di analisi, fare riferimento al file PDF nella repository principale...
Spring-Kafka-POC-CVE-2023-34040
Spring Kafka Deserialization POC Voraussetzungen Java 11 Maven Docker oder Kafka Verwendung Starten Sie zuerst die Dockerisierte Kafka-Instanz. Dadurch wird Kafka gestartet und auf Port 29092 verfĆ¼gbar gemacht. root@kitploit: docker-compose up Starten Sie die Consumer-Anwendung. root@kitploit: cd...
Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities
Summary IBM Data Risk Manager IDRM 2.0.6.19, which is the only supported version, is affected by multiple vulnerabilities. The vulnerabilities have been addressed in the updated version of IDRM 2.0.6.20. Please see the remediation steps below to apply the fix. All customers are encouraged to act...
Security Bulletin: VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component
Summary IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring for Apache Kafka which is vulnerable to CVE-2023-34040. Vulnerability Details CVEID:CVE-2023-34040 DESCRIPTION: VMware Tanzu Spring for Apache Kafka could allow a local authenticated attacker to execute arbitrary co...
CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...
CVE-2023-34040
CVE-2023-34040 affects VMware Tanzu Spring for Apache Kafka (versions 3.0.9 and earlier; 2.9.10 and earlier). The issue is a deserialization attack via specially crafted DeserializationException headers in messages when an application does not use an ErrorHandlingDeserializer for keys/values and ...