zkar

ZKar ZKar هي أداة تحليل لبروتوكول تسلسل Java مطبقة بلغة Go. هذه الأداة لا تزال قيد التطوير ، لذا لا توجد وثائق API كاملة ودليل مساهمة. تقدم ZKar: محلل وعارض لحمولات تسلسل Java بلغة Go خالصة، بدون الحاجة إلى CGO أو JDK تحويل من بروتوكول تسلسل Java إلى هيكل Go مكتبة Go يمكنها التعامل مع بيانات تسلس...

javaserializetools

Ce depot n’a pas de fichier README...

CVE-2020-9496

CVE-2020-9496 - RCE Étant donné que les 2 requêtes liées à xmlrpc dans webtools xmlrpc et ping n'utilisent pas d'authentification, elles sont vulnérables à une désérialisation non sécurisée. Ce problème a été signalé à l'équipe de sécurité par Alvaro Munoz [email protected] de l'équipe GitHu...

cve-2023-34040

CVE-2023-34040 Désérialisation Spring Kafka et exécution de code à distance root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko...

CVE-2023-34040

CVE-2023-34040 استغلال ثغرة إلغاء التسلسل في Spring Kafka لتنفيذ الأوامر عن بعد root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko...

XStream-1

master: v-1.4.x: XStream Sérialisation Java vers XML, et retour Binaires Tous les artefacts binaires sont regroupés dans l'archive -bin. Elle inclut les jars XStream et toute autre bibliothèque utilisée au moment de la compilation, ou des extensions optionnelles d'exécution. Xpp3 est recommandé c...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Сериализация Java в XML и обратно Бинарные файлы Все бинарные артефакты включены в архив -bin. Он содержит JAR-файлы XStream и все остальные библиотеки, используемые во время сборки, или дополнительные компоненты времени выполнения. Для использования рекомендуется MXParse...

x-stream__xstream_CVE-2013-7285_1-4-6

XStream root@kitploit: "Java에서 XML로의 직렬화, 그리고 다시 되돌리기" -- 바이너리 ----------------------------------------------- 모든 바이너리 아티팩트는 'lib' 디렉토리에 있습니다. 여기에는 빌드 시 사용되는 xstream jar와 기타 모든 라이브러리, 또는 선택적 런타임 확장 기능이 포함됩니다. XStream의 성능을 크게 향상시키므로 kXML2를 사용하는 것이 좋습니다. -- 문서...

x-stream__xstream_CVE-2021-21345_1-4-15

master: v-1.4.x: XStream Sérialisation Java vers XML, et inversement Binaires Tous les artefacts binaires sont regroupés dans l’archive -bin. Elle inclut les jars XStream et toute autre bibliothèque utilisée au moment de la compilation, ou des extras facultatifs à l’exécution. Xpp3 est recommandé...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput: репродуктор небезопасной десериализации CVE-2026-40473 Этот проект демонстрирует уязвимость десериализации в Java в компоненте Apache Camel camel-mina, отслеживаемую как CVE-2026-40473. Конвертер типов MinaConverter.toObjectInputIoBuffer оборачивает...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

PT-2026-55883

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in...

PT-2026-55884

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Control of Generation of Code ('Code Injection') (CVE-2026-27830)

Summary There are vulnerabilities in c3p0-0.9.5.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-27830. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via...

com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...

BIT-JAVA-MIN-2020-2756

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

CVE-2026-27172 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...