yamcs__yamcs_CVE-2023-45277_5-8-6

Yamcs 任务控制中心 网站：https://yamcs.org 邮件列表：Google Groups Yamcs 是一个用 Java 开发的任务控制框架。它采用开放式架构，允许通过 yaml 配置文件定制功能集。您也可以通过编写自定义 Java 类来扩展默认功能集。 要开始开发您自己的 Yamcs 应用程序，请按照我们的入门指南进行操作。 文档 服务器手册：https://docs.yamcs.org/yamcs-server-manual/ Javadoc：https://docs.yamcs.org/javadoc/yamcs/latest/ 许可证 Yamcs 遵循 Affer...

Apache-OFBiz-Authentication-Bypass

Apache OFBiz 认证绕过漏洞 CVE-2023-51467 和 CVE-2023-49070 此利用脚本和 PoC 是为在 vsociety 上进行深入的 CVE 分析而编写的。 Apache OFBiz 企业资源规划 ERP 系统是一种多功能的基于 Java 的 Web 框架，在各行业广泛使用，目前正面临严峻的安全挑战。SonicWall 威胁研究团队 发现 的 CVE-2023-51467（一个严重的认证绕过漏洞，CVSS 评分为 9.8）暴露了系统完整性的严重风险。该漏洞不仅使 ERP 系统面临被利用的可能，还为服务端请求伪造 SSRF 利用打开了大门，对依赖 Apach...

TLS-Attacker

TLS-Attacker TLS-Attacker 是一个基于 Java 的框架，用于分析 TLS 库。它能够以任意顺序向 TLS 对等端发送任意协议消息，并通过提供的接口定义其修改。这使开发人员能够轻松定义自定义 TLS 协议流程，并针对其 TLS 库进行测试。 请注意： TLS-Attacker 是一个面向 TLS 开发人员和渗透测试者的研究工具。没有图形界面，也没有绿灯/红灯指示。 编译与运行 为了编译和使用 TLS-Attacker，你需要安装 Java 和 Maven。在 Ubuntu 上，可以通过运行以下命令安装 Maven： $ sudo apt-get install...

apache__shiro_CVE-2023-34478_1-11-0

Apache Shiro Apache Shiro 是一个强大且易用的 Java 安全框架，提供身份验证、授权、加密和会话管理。借助 Shiro 易于理解的 API，您可以快速轻松地保护任何应用程序——从最小的移动应用程序到最大的 Web 和企业应用程序。 文档和示例 http://shiro.apache.org 教程 10 分钟教程 Web 应用程序 许可证 Apache License, Version 2.0...

BadBizness-CVE-2023-51467

BadBizness 针对 Java Web 框架 OF Biz 在 CVE-2023-51467 下的自动利用脚本。灵感来源于 HackTheBox 机器 Bizness。 使用方法与示例 此脚本需要工具 ysoserial 和 OpenJDK 11 版本。请参阅使用菜单进行安装。 使用你偏好的方法设置监听器以捕获 shell。以下是一个 netcat 示例： nc -nlvp 1337 执行脚本： python3 badbizness.py ysoserial-all.jar 的路径 目标基础 URL 监听 IP 监听端口 python3 badbizness.py...

perwendel__spark_CVE-2018-9159_2-7-1

Spark - 一个面向 Java 8 的微型 Web 框架 新闻 ：Spark 2.7.0 已发布。请试用它并报告任何 bug。 com.sparkjava spark-core 2.7.0 重要提示 - 较旧版本的 Spark（低于 2.5.2 的版本）存在一个漏洞。请升级到最新版本。 文档请访问：http://sparkjava.com/documentation 使用问题请使用 带有 “spark-java” 标签的 Stack Overflow Javadoc：http://javadoc.io/doc/com.sparkjava/spark-core 快速入门...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

The vulnerability of the normalization mechanism for security policies in the Java framework Apache Neethi, which allows a violator to trigger a service failure.

The vulnerability of the normalization mechanism for security policies in the Java framework Apache Neethi is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the PolicyReference programming interface in the Java framework of Apache Neethi allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PolicyReference programming interface in the Apache Neethi Java framework is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

TLS-Attacker v7.0.0-rtc

TLS-Attacker TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS...

TLS-Attacker v7.8.0

TLS-Attacker TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS...

The vulnerability of the Apache Camel JIRA Java framework component allows a malicious individual to gain unauthorized access to read, modify, add, and delete objects.

The vulnerability of the Apache Camel JIRA Java framework involves bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an intruder to gain unauthorized access to read, modify, add, and delete objects in the target JIRA system...

The vulnerability of the Java framework for securing industrial applications using Spring Security allows attackers to escalate their privileges.

The vulnerability of the Java framework for securing industrial applications using Spring Security involves bypassing authentication through phising techniques. Exploiting this vulnerability can allow attackers, operating remotely, to increase their privileges...

Sa-Token 代码问题漏洞

Sa-Token is a lightweight Java authentication framework open source by dromara. A code issue vulnerability exists in Sa-Token 1.44.0 and earlier versions, which stems from a misuse of the function ObjectInputStream.readObject in the file SaSerializerTemplateForJdkUseBase64.java, which could lead ...

CVE-2025-31129

Summary: CVE-2025-31129 affects the Jooby pac4j integration. In io.jooby.internal.pac4j.SessionStoreImpl#get, values are deserialized from untrusted data (notably for payloads starting with “b64~”), which can enable code execution. The issue is fixed in Jooby releases 2.17.0 (2.x stream) and 3.7....

Solon 安全漏洞

Solon is a new ecological application development framework for Java for noear individual developers in China. A security vulnerability exists in Solon 3.0.8 and earlier versions, which stems from a path traversal issue...

Supercharging Your AI Applications with Spring AI Advisors

In the rapidly evolving world of artificial intelligence, developers are constantly seeking ways to enhance their AI applications. Spring AI, a Java framework for building AI-powered applications, has introduced a powerful feature: the Spring AI Advisors. The advisors can supercharge your AI...