221 matches found
java-remote-class-loader
Cet outil vous permet d'envoyer du bytecode Java sous forme de fichiers de classe à vos clients ou cibles potentielles pour les charger et les exécuter en utilisant Java ClassLoader avec l'API Reflect. Le client reçoit le fichier de classe du serveur et renvoie la sortie d'exécution respective. L...
cve-2022-22965
Exemplo mínimo de CVE-2022-22965 No momento em que este texto foi escrito, a vinculação de parâmetros de requisição do spring-web WebDataBinder, por padrão, permite acessar o método getClass do objeto. Este é um detalhe de implementação interno específico da jvm na minha opinião, não deveria ser...
log4j-CVE-2021-44228-workaround
log4j-CVE-2021-44228-workaround A. Descrizione della soluzione Questo progetto fornisce una soluzione generica per la vulnerabilità log4j CVE-2021-44228, che può essere utilizzata nel caso in cui non si abbia l'alternativa a breve termine di ricostruire il proprio progetto o di applicare la patch...
spring-shell-vuln
spring-shell-vuln Spring4Shell: Vulnerabilità RCE di Spring Core Spring ha confermato la RCE nel framework Spring. Il team ha appena pubblicato la dichiarazione insieme alle guide di mitigazione per il problema. Ora, questa vulnerabilità può essere tracciata come CVE-2022-22965. Alcune informazio...
PT-2026-58858
Name of the Vulnerable Software and Affected Versions jadx versions 1.5.2 through 1.5.5 Description A path traversal issue exists where a malicious .xapk file can cause the application to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory...
CVE-2026-9498
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engin...
Dromara Lamp-Cloud 安全漏洞
Dromara Lamp-Cloud is dromara open source based on Jdk11 SpringCloud SpringBoot development of microservices in the backend rapid development platform . Dromara lamp-cloud 5.6.2 and earlier versions of a security vulnerability , the vulnerability stems from the Message Template Handler component ...
PT-2026-43117
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engin...
CVE-2026-7584 Arbitrary Code Execution via Unsafe Deserialization in LabOne Q
The LabOne Q serialization framework uses a class-loading mechanism importcls to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target...
Exploit for Missing Authorization in Scshr Hr_Portal
CVE-2025-48734: Apache Commons BeanUtils – enum declaredClass...
Security Bulletin: IBM Datapower Operations Dashboard may allow remote attackers to access the ClassLoader and execute arbitrary code CVE-2025-48734
Summary Apache Commons is used by the IBM Datapower Operations Dashboard in their Java components utility implementation Vulnerability Details CVEID:CVE-2025-48734 DESCRIPTION: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. Th...
Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts
Summary Multiple Apache Struts vulnerabilities have been addressed in IBM Library Support for Struts Vulnerability Details CVEID:CVE-2008-2025 DESCRIPTION: Cross-site scripting XSS vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise SLE 11, before 1.2.9-108.2 on SUSE...
Security Bulletin: Vulnerabilities in Apache Commons affects IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary Potential vulnerability in Apache Commons has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-48734 DESCRIPTION:...
MiracleLinux 4 : tomcat6-6.0.24-78.AXS4 (AXSA:2014-496:04)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-496:04 advisory. Description : Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...
CVE-2022-35912
In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 at least when certain Java 8 configurations are used, data binding allows a remote attacker to execute code by gaining access to the class loader...
CVE-2019-20635
codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...
Security Bulletin: Multiple vulnerabilities in IBM Disconnected Log Collector
Summary Multiple vulnerabilities were addressed in IBM Disconnected Log Collector version 2.0.0. Vulnerability Details CVEID:CVE-2025-48734 DESCRIPTION: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop...
Security Bulletin: Improper Access Control vulnerability in Apache Commons may affect IBM Business Automation Workflow - CVE-2025-48734
Summary IBM Business Automation Workflow packages a copy of Apache commons-beanutils. CVE-2025-48734 has been reported for this library. Vulnerability Details CVEID:CVE-2025-48734 DESCRIPTION: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in...
