5109 matches found
CVE-2017-7504-poc
JBoss 4.x JBossMQ JMS反序列化漏洞poc -h 查看使用方法...
CVE-2017-12149
CVE-2017-12149 编写者：1337g 用法：CVE-2017-12149.py http://targetip:port/ JBOSS 远程代码执行 我不知道为什么它不适用于https...
CVE-2017-12149
CVE-2017-12149 CVE-2017-12149 JBOSS as 6.X反序列化反弹shell版 根据作者命令行模式改写gui界面 detail:http://www.cnblogs.com/sevck/p/7874438.html...
jboss-autopwn
⚠️ NOTE: This tool is no longer under active maintenance. JBoss Autopwn 脚本 Christian G. Papathanasiou http://www.spiderlabs.com 简介 该JBoss脚本在目标JBoss AS服务器上部署一个JSP Shell。部署后，脚本利用其上传和命令执行功能提供一个交互式会话。 功能包括： 多平台支持——已在Windows、Linux和Mac目标上测试 支持绑定Shell和反向连接Shell 针对Windows目标的Meterpreter Shell和VNC支持 安装 依赖项包...
jboss-deserialization
JBoss不安全的反序列化导致RCE：CVE-2017-12149 JBoss不安全反序列化 - RCE利用实验室。 这里的想法是搭建一个包含旧版本JBoss（7.0）的实验室，以便利用该漏洞。 我们可以使用Docker来简化整个过程。为此，我们需要一个Oracle JDK rpm包，因为JBoss 6.0.0最终版需要JDK 6运行时。我们还需要仓库中的Dockerfile，并且系统上显然必须安装Docker。确保所有文件都在同一目录下。 1. 使用git clone https://github.com/Xcatolin/jboss-deserialization克隆此仓库 2...
Red Hat JBoss - Insecure Deserialization
Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...
cve-2017-12149-playground
许多关键行业（银行业、医疗保健和制造业）仍然依赖专为 JBoss 5 或 6 运行而构建的遗留中间件。由于这些应用程序往往过于脆弱，无法迁移到 WildFly（JBoss 的继任者）的现代版本，组织选择将其"物理隔离"（air-gap）或隐藏在 VPN 之后，而不是对它们进行修补。当这些边界防御失效时，漏洞仍然存在——活跃且未修补。 JBoss AS 6.1.0 漏洞研究实验室 本仓库提供了一个容器化的 JBoss Application Server 6.1.0 环境，专门为安全研究和漏洞验证而配置。其设计目的是演示 Java 反序列化和 JBoss Seam EL 注入漏洞。 快速开...
serialator
serialator Python script to exploit CVE-2015-4852. Description During a recent engagement, I found that Nessus was now actively exploiting vulnerabilities for confirmation. When I checked the associated nasl script I found that the payload was generic enough to be used on a standalone script...
CVE-2018-14667_Lab_POC
CVE-2018-14667-Lab LAB PREREQUISITES Demo App From : http://downloads.jboss.org/richfaces/releases/3.3.X/3.3.4.Final/richfaces-examples-3.3.4.Final.zip Jboss 5.1.0.GA from JBOSS download archive : https://repository.jboss.org/sourceforge/ Jdk-6u45-linux-x64 from JAVA archive :...
CVE-2018-14667_Lab_POC
CVE-2018-14667-Lab POC para la explotación de CVE-2018-14667 REQUISITOS PREVIOS App de demostración desde: http://downloads.jboss.org/richfaces/releases/3.3.X/3.3.4.Final/richfaces-examples-3.3.4.Final.zip Jboss 5.1.0.GA desde el archivo de descargas de JBOSS:...
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet formerly UNC5669 since 2024. Google Threat Intelligence Group GTIG and Mandiant teams described the threat actor as "specializing in manipulating...
CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
UBUNTU-CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
CVE-2026-81624 Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
Linux Distros Unpatched Vulnerability : CVE-2026-81624
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certai...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: jboss-logging (UTSA-2026-031578)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031578 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: jboss-logging (UTSA-2026-031579)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031579 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...