SUSE CVE-2011-1484

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language EL statements i...

SUSE CVE-2014-7810

The Expression Language EL implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanis...

Exploit for Expression Language Injection in Vmware Spring_Cloud_Gateway

Introduction Through CVE-2022-22947, an attack is attempte...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134check The script is used to check remotely if...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 练习 go 写 poc 用法 bash go get -u -v gith...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6703016755724288 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

PT-2022-6758 · Hitachi · Hitachi Replication Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Replication Manager versions prior to 8.8.5-02 Description: The issue affects Hitachi Replication Manager and is related to an Expression Language Injection vulnerability, allowing code injection. This vulnerability can be exploited b...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

CVE-2022-22947 Usage: python3 CVE-2022-22947.py url...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation. Remediation There is no fixed version for com.bstek.uflo:uflo-core...

HPE Intelligent Management Center Code Execution

The vulnerability of the HPE Intelligent Management Center PLAT software lies in the lack of measures taken to neutralize special elements used in the expression language during the processing of the beanName parameter at the select.xhtml endpoint. Exploiting this vulnerability allows an attacker...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 Installation Download the Python scri...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

Installation git clone https://github.com/CJ-0107/cve-20...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 ATLASIAN-Confluence RCE Installa...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

PoC exploit for CVE-2022-26134, a remote code execution vulnerab...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

It is an offensive tool for web exploitation. The repository is...

HPE Intelligent Management Center Code Execution

The vulnerability of the HPE Intelligent Management Center PLAT software lies in the lack of measures taken to neutralize special elements used in the expression language during the processing of the beanName parameter at the devGroupSelect.xhtml endpoint. Exploiting this vulnerability allows an...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134-LAB Confluence Server and Confluence Data Cent...

cron-utils: template Injection leading to unauthenticated Remote Code Execution

A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution RCE via Java Expression Language EL injection...

Nepxion security vulnerabilities

Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...

PT-2022-16005 · Nepxion · Nepxion Discovery

Name of the Vulnerable Software and Affected Versions: Nepxion Discovery affected versions not specified Description: The issue is related to SpEL Injection in discovery-commons, where the DiscoveryExpressionResolver’s eval method evaluates expressions with a StandardEvaluationContext. This allow...