28 matches found
CVE-2025-30065
CVE-2025-30065 研究笔记 此仓库刻意保持小巧且可读性高。它旨在用于对 Apache Parquet / Avro 模式处理中的 CVE-2025-30065 进行授权安全研究、本地验证和防御性研究。 本 README 侧重于仓库卫生、构建可复现性和安全使用。它不提供可操作的漏洞利用指导。 仓库内容 一个基于 Java 的研究框架。 一组用于在受控实验室中研究此漏洞的少量源文件。 一个 Maven 构建定义。 一个辅助脚本，用于在本地编译和运行项目。 前提条件 Java 8 或更新版本。 Maven。 一个您拥有或得到明确授权使用的受控测试环境。 构建和运行...
parquet-canary-exploit-rce-poc-CVE-2025-30065
Parquet CVE-2025-30065 的 Canary 漏洞利用 root@kitploit: -. '-. OO OO .-----,--/ ,. ,------. .-----. .----. .-----..------. .-----. .----. .----. ,--. .------. ' .--.\ \ //| .---' .-'/ ,-. / .. / ,-. | | .-' / -. / .. \ / .. \ / .' | | | |'-.\ \ / / | | OO'-' | . / \ '-' | | '--. OO'-' ' . / \ . / ...
CVE-2025-30065-PoC
CVE-2025-30065 PoC 使用方法 构建镜像 root@kitploit: docker build -t cve-2025-30065 . 生成恶意 Parquet 文件 root@kitploit: docker run --rm -v $pwd:/poc/out cve-2025-30065 generate "cat /etc/passwd" ./out/malicious.parquet 触发漏洞利用 root@kitploit: docker run --rm -v $pwd:/poc/out cve-2025-30065 trigger...
parquet-rce-poc-CVE-2025-30065
CVE-2025-30065 本仓库演示了如何利用 CVE-2025-30065 实现远程类实例化，并在受害者应用程序（即 JVM）内部触发网络请求，从而实现 SSRF。 Malicious.java 生成的 parquet 文件假定类 RCEPayload.java 已存在于类路径中，但这并不现实。你可以通过执行 Reader.java 来触发该 PoC。 MaliciousSSRF.java 从攻击者的角度来看更为可行，它会触发一个网络连接，该连接可以是内网或外网的。 还可以寻找其他 gadget 来实现 RCE（难点在于找到一个接受字符串作为参数并导向 RCE 的指令，这不像普通的...
Security Bulletin: Due to the use of IBM Tivoli Monitoring and IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities
Summary IBM Tivoli Monitoring code execution and IBM Db2 vulnerabilities have been found in IBM Tivoli Monitoring shipped with IBM Cloud Pak System IBM Tivoli MonitoringITM patternType itm pType, and IBM Cloud Pak System DB2 pattern type db2 pType shipped with Cloud Pak System. Vulnerabilities we...
Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in Apache Parquet (CVE-2025-30065).
Summary Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.15.1, which fixes the issue. Note: A Db2 server is not vulnerable to CVE-2025-30065 if the database manager...
Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to tampering and elevation of privilege (CVE-2025-30065) due to the use of IBM Db2
Summary IBM Virtualization Engine TS7700 is susceptible to a tampering and privilege escalation vulnerability CVE-2025-30065, due to the use of IBM Db2, which is primarily embedded to store metadata related to the data it manages. Additionally, this patch also includes updates for other...
Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera
Summary On April 1, 2025, a critical vulnerability in the parquet-avro module of Apache Parquet CVE-2025-30065, CVSS score 10.0 was announced. Vulnerability Details CVEID:CVE-2025-30065 DESCRIPTION: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows ba...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
CVE-2025-30065 == Dangerous Deserialization in Parquet-Avro 🔥...
Security Bulletin: Apache Parquet vulnerabilities affect watsonx.data
Summary Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code and this could affect watsonx.data. Vulnerability Details CVEID:CVE-2025-30065 DESCRIPTION: Schema parsing in the parquet-avro module of Apache Parquet 1.15...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
Canary Exploit for Parquet CVE-2025-30065...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
TRAI-001 CVE-2025-30065: Apache Parquet Remote Code Execution...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
TRAI-001 CVE-2025-30065: Apache Parquet Remote Code Execution...
Apache Parquet < 1.15.1 Remote Code Execution (CVE-2025-30065)
The version of Apache Parquet on the remote host is prior to 1.15.1. It is, therefore, affected by a remote code execution vulnerability: - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
CVE-2025-30065 This repository illustrates how to exploit CVE...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
CVE-2025-30065 PoC Usage Build the image sh docker b...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
💥 CVE-2025-30065 - Parquet Deserialization PoC This project d...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
CVE-2025-30065 Proof of Concept - Apache Parquet RCE FOR EDUC...
Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code
A maximum severity security vulnerability has been disclosed in Apache Parquet's Java Library that, if successfully exploited, could allow a remote attacker to execute arbitrary code on susceptible instances. Apache Parquet is a free and open-source columnar data file format that's designed for...
