log4j2-web-vulnerable

log4j2-web-vulnerable Una semplice web app vulnerabile per il test dell'exploit RCE di log4j2 CVE-2021-44228. Avvio Esegui java -jar target/gs-handling-form-submission-0.1.0.jar. Accedi a http://127.0.0.1/greeting Se vuoi compilarla da solo, usa una versione di JDK 8u20...

damn-vulnerable-log4j-app

SnapAttack Log4j / CVE-2021-44228 / log4shell Ressourcen Was ist enthalten? Damn Vulnerable Log4j App damn-vulnerable-log4j-app enthält einen einfachen, anfälligen Java-Servlet, der den User-Agent, HTTP GET- und POST-Parameter mit log4j protokolliert. Es ist als .war-Datei verpackt und kann auf...

BadBizness-CVE-2023-51467

BadBizness Script di sfruttamento automatico per il framework web Java OF Biz sotto CVE-2023-51467. Ispirato alla macchina HackTheBox Bizness. Utilizzo ed Esempio Questo script richiede lo strumento ysoserial e OpenJDK versione 11. Consulta il menu di utilizzo per l'installazione. Configura un...

EUVD-2026-66838

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...

CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...

CVE-2026-47864

Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request carrying Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is passed directly to r...

log4j

💻 -h3x0v3rl0rd- эксплуатация log4j CVE-2021-44228 TryHackMe Solar, прохождение root@kitploit: git clone https://github.com/n3rdh4x0r/log4j.git 1. Запустите log4j.py это установит все необходимые приложения и запустит LDAP-сервер root@kitploit: ifconfig tun0 python3 log4j.py 10.8.227.251 2...

mojarragadget

mojarragadget описание Мы обнаружили новую цепочку гаджетов в библиотеке Mojarra Library, в этом репозитории содержатся 2 PoC для воспроизведения уязвимости в версиях 2.3 и 3.0. Дополнительная информация здесь: https://www.synacktiv.com/publications/finding-gadgets-like-its-2015-part-1.html...

cve-2023-4863-analysis

CVE-2023-4863 libwebp — Projet d'analyse pédagogique et de défense...

QLinspector

QLinspector Finden von Java/C-Gadget-Chains mit CodeQL. Weitere Informationen in unserem Artikel Installation Repository klonen root@kitploit: $ git clone https://github.com/synacktiv/QLinspector.git Nach Gadgets suchen: root@kitploit: $ codeql database analyze log4j --format=sarif-latest...

ESAPI__esapi-java-legacy_CVE-2022-23457_2-2-3-1

Enterprise Security API для Java Legacy OWASP® ESAPI The OWASP Enterprise Security API — это бесплатная библиотека с открытым исходным кодом для контроля безопасности веб-приложений, которая упрощает программистам создание приложений с меньшим риском. Библиотека ESAPI для Java предназначена для...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE

SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass CVE-2025-40536, remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to...

RWS WorldServer - Authentication Bypass

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint. id: CVE-2022-34267 info: name: RWS...

CVE-2026-25747

Reproducer für die LevelDB-Deserialisierungsschwachstelle Dieses Projekt demonstriert eine Java-Deserialisierungsschwachstelle im Apache-Camel-LevelDB-Aggregations-Repository, ähnlich zu CVE-2024-23114 die das Cassandra-Aggregations-Repository betraf. Zusammenfassung der Schwachstelle...

CVE-2012-4681-Armoring

CVE-2012-4681-Armoring 概述 一项针对 CVE-2012-4681 的手动抗病毒规避装甲实验，灵感来源于 http://security-obscurity.blogspot.com/2012/11/java-exploit-code-obfuscation-and.html。 基础利用代码: http://pastie.org/4594319 截至2014年9月26日和2016年8月2日的检测结果...

marshalsec

Java Unmarshaller Security - 데이터를 코드 실행으로 바꾸기 Log4Shell/CVE-2021-44228 때문에 여기에 오셨다면, 공격 벡터와 영향을 받는 Java 런타임 버전에 대해 읽어보시기 바랍니다: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ 논문 Chris Frohoff와 Garbriel Lawrence가 Java 객체 역직렬화 취약점에 대한 연구를 발표한 지 2년 이상이 지났습니다. 그 연구는 궁극적으로 Java 역사상 가장...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Ausnutzen der Java-Deserialisierungsschwachstelle mit Burp Suite 0x01 Aufbau der Jboss JMXInvokerServlet-Deserialisierungsschwachstelle Testumgebung: JBoss JMXInvokerServlet-Deserialisierungsschwachstelle Prinzip der Schwachstelle: JBoss liest in der...

A-potential-Denial-of-Service-issue-in-protobuf-java

Ein potenzielles Denial-of-Service-Problem in protobuf-java Ein potenzielles Denial-of-Service-Problem in protobuf-java mit hoher Schwere, von GitHub geprüft, veröffentlicht vor 5 Tagen in protocolbuffers/protobuf • Aktualisiert gestern Details zur Sicherheitslücke Dependabot-Alerts 2 Paket...

CVE-2022-21445

CVE-2022-21445 Exploit - PoC Этот набор инструментов генерирует эксплуатационные полезные нагрузки для CVE-2022-21445, критической уязвимости десериализации Java, затрагивающей Oracle WebLogic Server 12.2.1.x с Oracle ADF Faces. Ошибка существует в компоненте RemoteApplicationResourceLoader и...