vuln4japi

vuln4japi Un'API REST Java vulnerabile per dimostrare la CVE-2021-44228 log4shell. Motivazione Log4Shell ha travolto internet all'inizio di dicembre 2021. Una vulnerabilità Zero Day nella libreria di logging Apache Log4j, capace di eseguire codice in remoto RCE, che ha costretto organizzazioni in...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Laboratoire de désérialisation non sécurisée en Java Application REST Java basique vulnérable à la désérialisation non sécurisée, conduisant à une exécution de code à distance RCE. Le projet doit être exécuté sur Java 8u45 Basé sur Maven avec les dépendances suivantes :...

Security Bulletin: z/Transaction Processing Facility is affected by multiple vulnerabilities in the jackson-databind, jackson-dataformat-xml, jackson-core, slf4j-ext, and cxf-core packages

Summary The z/TPF system was updated to address all the vulnerabilities described by the CVEs that are listed in the Vulnerability Details. These vulnerabilities are related to REST services that are implemented in Java. Vulnerability Details CVEID:CVE-2019-12086 DESCRIPTION: FasterXML...

CVE-2016-2923

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...