Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Burp Suite를 사용하여 Java 역직렬화 취약점 악용 0x01 Jboss JMXInvokerServlet 역직렬화 취약점 구축 테스트 환경: JBoss JMXInvokerServlet 역직렬화 취약점 취약점 원리: JBoss는 /invoker/JMXInvokerServlet 요청에서 사용자가 전달한 객체를 읽은 다음, Apache Commons Collections의 Gadget을 활용하여 임의 코드를 실행합니다...

jboss-autopwn

jboss-autopwn JBoss Autopwn은 BlackHat Europe 2010에서 소개된 도구입니다. 이 버전은 Minded Security가 발견한 JBoss 인증 우회 VERB 조작 취약점CVE-2010-0738을 포함합니다. C. Papathanasiou 2010 INTRODUCTION 이 JBoss 스크립트는 대상 JBoss AS 서버에 JSP 셸을 배포합니다. 배포 후 스크립트는 업로드 및 명령 실행 기능을 통해 대화형 세션을 제공합니다. 기능: 다중 플랫폼 지원 - Windows, Linux 및 Mac...

jboss-autopwn-1

jboss-autopwn JBoss Autopwn as featured at BlackHat Europe 2010 - this version incorporates CVE-2010-0738 the JBoss authentication bypass VERB manipulation vulnerability as discovered by Minded Security C. Papathanasiou 2010 INTRODUCTION This JBoss script deploys a JSP shell on the target JBoss A...

CVE-2017-12149

CVE-2017-12149 CVE-2017-12149 JBOSS as 6.X逆シリアル化リバースシェル版 作者のコマンドラインモードに基づいてGUIインターフェースを書き換える 詳細:http://www.cnblogs.com/sevck/p/7874438.html...

jboss-autopwn

⚠️ 주의: 이 도구는 더 이상 적극적으로 유지보수되지 않습니다. JBoss Autopwn Script Christian G. Papathanasiou http://www.spiderlabs.com 소개 이 JBoss 스크립트는 대상 JBoss AS 서버에 JSP 셸을 배포합니다. 일단 배포되면, 이 스크립트는 업로드 및 명령 실행 기능을 사용하여 대화형 세션을 제공합니다. 주요 기능은 다음과 같습니다: 멀티플랫폼 지원 - Windows, Linux 및 Mac 대상에서 테스트됨 바인드bind 및 리버스 바인드reverse bin...

cve-2017-12149-playground

은행, 의료, 제조와 같은 많은 핵심 산업은 JBoss 5 또는 6에서만 실행되도록 구축된 레거시 미들웨어에 의존합니다. 이러한 애플리케이션은 최신 버전의 WildFlyJBoss의 후속 제품로 마이그레이션하기에는 너무 취약한 경우가 많기 때문에, 조직은 패치를 적용하는 대신 "에어갭air-gap" 처리하거나 VPN 뒤에 숨기는 선택을 합니다. 이러한 경계 방어가 실패하면 취약점은 여전히 활성 상태로 패치되지 않은 채 남아 있습니다. JBoss AS 6.1.0 취약점 연구 랩 이 저장소는 보안 연구 및 취약점 검증을 위해 특별히...

EUVD-2012-2305

Malware in sbrugna...

EUVD-2009-5021

Malware in sbrugna...

EUVD-2022-1860

Malicious code in bioql PyPI...

GHSA-WQ8G-HM94-5RQQ JBoss AS may expose root content if excluded-contexts list is mismatched

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

JBoss AS may expose root content if excluded-contexts list is mismatched

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

CVE-2012-1094

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

Design/Logic Flaw

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

CVE-2012-1094

Summary: CVE-2012-1094 affects Red Hat/JBoss AS 7 before 7.1.1 with mod_cluster. The issue arises from how a default hostname is handled, causing the excluded-contexts list to be mismatched and the root context to be exposed. Affected software: JBoss Application Server 7.x up to 7.1.0 (and mod_cl...

CVE-2012-1094

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

CVE-2012-1094: Exposure of Sensitive Information to an Unauthorized Actor

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

Red Hat JBoss EAP and JBoss Application Server Privilege Vulnerability

Red Hat JBoss Application Server is a U.S. Red Hat Red Hat company based on Java EE open source application server. The product has a startup ultra-fast , lightweight , modular design , hot and parallel deployment , simple management , domain management and the first class components and other...

Input validation

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...