CVE-2019-2725

CVE-2019-2725 CVE-2019-2725CNVD-C-2019-48814、WebLogic wls9-async Eco de comando 10.3.6 12.1.3 ResultBaseExec.java Usado para testar defineClass, irá restaurar a classe maliciosa a partir de base64, executar código, principalmente por conveniência pode ser usado ou não. JDK7u21.java Irá gerar o xm...

Weblogic-CVE-2020-2551-To-Internet

Weblogic-CVE-2020-2551-To-Internet CVE-2020-2551 POC para usar na Internet POC de teste pode ser usado para testes externos python CVE-2020-2551.py HOST IP Tentativa de modificar o codebase para carregamento remoto de classes falhou python CVE-2020-TEST.py HOST IP Breve discussão sobre a...

CVE-2022-41828

CVE-2022-41828 Driver JDBC do Amazon AWS Redshift — Execução Remota de Código RCE O Driver JDBC da Amazon para Redshift é um driver JDBC Tipo 4 que fornece conectividade de banco de dados por meio das interfaces padrão de programação de aplicativos APIs JDBC disponíveis nas Edições Enterprise da...

java-remote-class-loader

Mit diesem Tool können Sie Java-Bytecode in Form von Class-Dateien an Ihre Clients oder potenzielle Ziele senden, um ihn mit Java ClassLoader und der Reflect API zu laden und auszuführen. Der Client empfängt die Class-Datei vom Server und gibt die entsprechende Ausgabe zurück. Payloads müssen in...

CVE-2022-40146_Exploit_Jar

Apache Batik SSRF से RCE Jar एक्सप्लॉइट Component लिंक https://github.com/apache/xmlgraphics-batik ब्लॉग https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading उपयोग कमांड बदलने के लिए...

CVE-2021-44228

CVE-2021-44228 Acho que esta história é mais prática risos christophetd/log4shell-vulnerable-app Só pesquisei por interesse e impulso, então podem haver partes incertas ou erros. Por favor, faça por sua conta e risco. Criar um ambiente de reprodução. Acredita-se que funcione em ambientes Linux. 1...

hka-seminar-log4shell

Seminararbeit - Log4Shell-Schwachstellen-Demonstration CVE-2021-44228 Sicherheitshinweis Dieses Repository dient ausschließlich zu Bildungs- und Demonstrationszwecken im Rahmen einer sicherheitsbezogenen Seminararbeit. Verwenden Sie diesen Code nicht in Produktionsumgebungen oder gegen Systeme oh...

graylog-cve-2024-24824-exploit

Ausnutzung von beliebigem Klassenladen auf der JVM Dieses Repository enthält den Proof-of-Concept-Exploit, der in meinem Vortrag vorgestellt wurde: Ausnutzung von beliebigem Klassenladen auf der JVM Schauen Sie es sich hier an, wenn Sie interessiert sind: Youtube Der Exploit zielt auf...

yaml-payload

yaml-payload SnakeYAML deserialization शोषण पेलोड CVE-2022-1471 के लिए, artsploit/yaml-payload से अनुकूलित मूल रूप से mbechler/marshalsec पर आधारित। यह क्या करता है जब SnakeYAML के असुरक्षित Yaml.load के माध्यम से लोड किया जाता है, तो यह पेलोड चल रहे एप्लिकेशन को नियंत्रित कर लेता है और इसे "You'...

Deserialization Of Untrusted Data

RabbitMQ Java client library is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the javaReturnType value from an untrusted system.describe response being passed to Class.forName with class initialization enabled, which allows an attacker capable of intercepting or...

CVE-2026-16723

🚨 CVE-2026-16723 — استغلال RCE في fastjson 1.2.83 عبر سلسلة استطلاع الموارد @JSONType مشروع إعادة إنتاج لتحميل الفئات عن بُعد / تنفيذ الأوامر في fastjson 1.2.66 1.2.83 عبر تعليمة@JSONType + اسم الفئة غير القانوني + بروتوكول jar:. ⚠️ إخلاء مسؤولية هذا المشروع مخصّص للبحث الأمني وإعادة إنتاج الثغرات...

CVE-2026-47858

CVE-2026-47858 — تنفيذ كود عن بُعد عبر JMX دون مصادقة في وضع live information في Spring Tools PoC English README | إعلان الثغرة: Spring Security Advisory | سجل CVE الثغرة : عند تشغيل تطبيقات Spring Boot عبر Spring Tools for Eclipse ≤ 5.2.0 / VSCode·Cursor·Theia ≤ 2.2.0 في وضع live information مفع...

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forNamejavaReturnType with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist. Vulnerable code ProcedureDescription.java:101-127: When a JsonRpcClient connects, it calls...

GHSA-6G32-PXV4-2WFJ RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forNamejavaReturnType with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist. Vulnerable code ProcedureDescription.java:101-127: When a JsonRpcClient connects, it calls...

CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

CVE-2026-63337

The RabbitMQ Java client (pre-5.33.0) passes an untrusted javaReturnType from system.describe through Class.forName with initialization enabled, allowing an attacker controlling broker responses to trigger arbitrary class static initializers in the victim JVM, affecting confidentiality, integrity...

CVE-2026-63337 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

EUVD-2026-61043

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

CVE-2026-63337 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2026:3614-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3614-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIM...