Jmeter-CVE-2018-1297-

JMeter RMI 反序列化命令执行漏洞 CVE-2018-1297 Apache JMeter 是美国 Apache 软件基金会使用 Java 语言编写的一套开源软件，用于压力测试和性能测试。 2.x 和 3.x 版本存在反序列化漏洞，攻击者可利用该漏洞在目标服务器上执行任意命令。 搭建漏洞环境： docker compose up -d 我使用了 Kali Linux 上的 docker。 执行完成后，RMI 服务启动并监听 1099 端口。 漏洞利用： 直接使用 ysoserial 进行漏洞利用。 java -cp ysoserial-0.0.6-SNAPSHOT-all.jar...

cve-2022-42889-jmeter

CVE 2022-42889 此脚本 用于移除旧版本的 Apache Commons Text 1.9，并将其替换为 位于 JMETERHOME/lib 文件夹中的新版本（1.10.0）。...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: logstash, mongodb-search, traccar, camunda-zeebe, gradle, zookeeper, jenkins, commercial-elasticsearch, pinot, kates-fips, apache-nifi, flyway-fips, akhq, kafbat-ui-fips, apache-tomee, s3proxy-fips, knative-kafka-broker-fips, kafbat-ui, apache-tika-fips,...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: logstash, mongodb-search, traccar, camunda-zeebe, gradle, zookeeper, jenkins, commercial-elasticsearch, pinot, kates-fips, apache-nifi, flyway-fips, akhq, kafbat-ui-fips, apache-tomee, s3proxy-fips, knative-kafka-broker-fips, kafbat-ui, apache-tika-fips,...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: logstash, mongodb-search, traccar, camunda-zeebe, gradle, zookeeper, jenkins, commercial-elasticsearch, pinot, kates-fips, apache-nifi, flyway-fips, akhq, kafbat-ui-fips, apache-tomee, s3proxy-fips, knative-kafka-broker-fips, kafbat-ui, apache-tika-fips,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: logstash, mongodb-search, traccar, camunda-zeebe, gradle, zookeeper, jenkins, commercial-elasticsearch, pinot, kates-fips, apache-nifi, flyway-fips, akhq, kafbat-ui-fips, apache-tomee, s3proxy-fips, knative-kafka-broker-fips, kafbat-ui, apache-tika-fips,...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: logstash, mongodb-search, traccar, camunda-zeebe, gradle, zookeeper, jenkins, commercial-elasticsearch, pinot, kates-fips, apache-nifi, flyway-fips, akhq, kafbat-ui-fips, apache-tomee, s3proxy-fips, knative-kafka-broker-fips, kafbat-ui, apache-tika-fips,...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: logstash, mongodb-search, traccar, camunda-zeebe, gradle, zookeeper, jenkins, commercial-elasticsearch, pinot, kates-fips, apache-nifi, flyway-fips, akhq, kafbat-ui-fips, apache-tomee, s3proxy-fips, knative-kafka-broker-fips, kafbat-ui, apache-tika-fips,...

CVE-2023-25573

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

EUVD-2019-0394

Malware in sbrugna...

EUVD-2022-4306

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-1297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using Distributed Test only RMI based, Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngi...

Linux Distros Unpatched Vulnerability : CVE-2019-0187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unauthenticated RCE is possible when JMeter is used in distributed mode -r or -R command line options. Attacker can establish a RMI connection to a jmeter-serve...

Linux Distros Unpatched Vulnerability : CVE-2018-1287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache JMeter 2.X and 3.X, when using Distributed Test only RMI based, jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get...

VulnCheck KEV: CVE-2023-25573

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25573

Metersphere contains an improper access control vulnerability: unauthenticated users can download arbitrary files via /api/jmeter/download/files, exposing sensitive data. Affected versions include those prior to the fixes, with remediation in versions 1.20.20 lts and 2.7.1. The issue stems from i...

MeterSphere 安全漏洞

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere versions before 1.20.20 lts and 2.7.1 have a security vulnerability that stems from incorrect access control in the file /api/jmeter/download/files, which can be exploited by an attacker to downlo...

CVE-2023-25573: Missing Authorization

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

K89010078: Apache vulnerabilities CVE-2018-1307, CVE-2018-1298, CVE-2018-1299, CVE-2018-1287, and CVE-2018-1297

Security Advisory Description CVE-2018-1307 In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and...

GHSA-7V85-6HV2-RWGW Missing certificate validation in Apache JMeter

When using Distributed Test only RMI based, Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code...