hka-seminar-log4shell

セミナー論文 - Log4Shell脆弱性デモンストレーション CVE-2021-44228 セキュリティに関する注意事項 このリポジトリは、セキュリティ関連のセミナー論文の一環として、教育およびデモンストレーション目的のみ に使用されます。本コードを本番環境や明示的な許可なしにシステムに対して使用しないでください。この構成は、ロギング、名前解決、クラスの動的ローディングといった一見無害な機能が組み合わさると、どのように複雑な脆弱性が生じるかを示し、セキュリティ意識を高めることを目的としています。 目次 1. プロジェクト概要 1.1 セミナー論文の目的 1.2 デモンストレーションの概...

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

EUVD-2026-67714

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-82078

CVE-2026-82078 is an unsafe dynamic class loading vulnerability (CWE-470, CVSS 9.4 Critical) in the database connection utilities of PaperCut NG and PaperCut MF . The application instantiates database driver classes from configurable names without an allowlist, allowing arbitrary Java bytecode to...

VulnCheck KEV: CVE-2026-82078

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained...

EUVD-2026-26483

The LabOne Q serialization framework uses a class-loading mechanism importcls to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target...