Apache-OFBiz-Authentication-Bypass

Vulnerabilidad de Bypass de Autenticación en Apache OFBiz CVE-2023-51467 y CVE-2023-49070 Este script de exploit y PoC están escritos para un análisis detallado de CVE en vsociety. El sistema de planificación de recursos empresariales ERP Apache OFBiz, un marco web versátil basado en Java...

TLS-Attacker

TLS-Attacker TLS-Attacker es un framework basado en Java para analizar bibliotecas TLS. Es capaz de enviar mensajes de protocolo arbitrarios en un orden arbitrario al par TLS, y definir sus modificaciones utilizando una interfaz proporcionada. Esto le brinda al desarrollador la oportunidad de...

perwendel__spark_CVE-2018-9159_2-7-1

Spark - un pequeño framework web para Java 8 NOTICIAS : ¡Spark 2.7.0 ha sido lanzado! Por favor, pruébalo y reporta cualquier error. root@kitploit: com.sparkjava spark-core 2.7.0 Importante - Existe una vulnerabilidad en versiones antiguas de Spark versiones inferiores a 2.5.2. Actualiza a la...

yamcs__yamcs_CVE-2023-45277_5-8-6

Yamcs Mission Control Webサイト: https://yamcs.org メーリングリスト: Google Groups Yamcs は Java で開発されたミッションコントロールフレームワークです。拡張可能なアーキテクチャを採用しており、yaml 設定ファイルを使用して機能セットを調整できます。また、カスタム Java クラスを作成してデフォルトの機能セットを拡張することもできます。 独自の Yamcs アプリケーションの開発を始めるには、Getting Started ガイドに従ってください。 ドキュメント サーバーマニュアル:...

apache__shiro_CVE-2023-34478_1-11-0

Apache Shiro Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the...

BadBizness-CVE-2023-51467

BadBizness Script de explotación automática para el framework web Java OF Biz bajo CVE-2023-51467. Inspirado en la máquina de HackTheBox Bizness. Uso y Ejemplo Este script requiere la herramienta ysoserial y OpenJDK versión 11. Consulta el menú de uso para la instalación. Configura un listener pa...

Sa-Token 代码问题漏洞

Sa-Token is a lightweight Java authentication framework open source by dromara. A code issue vulnerability exists in Sa-Token 1.44.0 and earlier versions, which stems from a misuse of the function ObjectInputStream.readObject in the file SaSerializerTemplateForJdkUseBase64.java, which could lead ...

CVE-2025-31129

Summary: CVE-2025-31129 affects the Jooby pac4j integration. In io.jooby.internal.pac4j.SessionStoreImpl#get, values are deserialized from untrusted data (notably for payloads starting with “b64~”), which can enable code execution. The issue is fixed in Jooby releases 2.17.0 (2.x stream) and 3.7....

Solon 安全漏洞

Solon is a new ecological application development framework for Java for noear individual developers in China. A security vulnerability exists in Solon 3.0.8 and earlier versions, which stems from a path traversal issue...

Supercharging Your AI Applications with Spring AI Advisors

In the rapidly evolving world of artificial intelligence, developers are constantly seeking ways to enhance their AI applications. Spring AI, a Java framework for building AI-powered applications, has introduced a powerful feature: the Spring AI Advisors. The advisors can supercharge your AI...

The vulnerability of the AuthenticatedVoter class in the Java framework for securing industrial applications with Spring Security allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the AuthenticatedVoter class in the Java framework for securing industrial applications under Spring Security is related to deficiencies in access control when processing the null parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

Fedora: Security Advisory for beust-jcommander (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: beust-jcommander-1.82-9.fc40

JCommander is a very small Java framework that makes it trivial to parse command line parameters with annotations...

The vulnerability of the Gradle plugin for the Quarkus Java framework, which allows a hacker to exploit and disclose protected information

The vulnerability of the Gradle plugin for the Quarkus Java framework is related to the disclosure of information through environment variables. Exploiting this vulnerability allows an attacker to disclose the protected information...

CVE-2024-23639 micronaut-core management endpoints vulnerable to drive-by localhost attack

Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical ...

CVE-2024-23639

Affected product: Micronaut Framework (micronaut-core). Vulnerability: Enabled but unsecured management endpoints allow drive-by localhost attacks when a malicious site issues HTTP requests to localhost, potentially bypassing CORS checks for some simple requests. Impact: Local development environ...

Magic-Api Code Injection Vulnerability

magic-api is sssssssss-team open source a Java-based interface rapid development framework . A code injection vulnerability exists in Magic-Api version 2.0.1 and earlier versions. Attackers exploit this vulnerability to cause code injection...

The vulnerability of the mvcRequestMatch component in the Java framework for securing industrial applications using Spring Security allows attackers to compromise the integrity of protected information.

The vulnerability of the mvcRequestMatch component in the Java framework for securing industrial applications using Spring Security is related to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker to compromise the integrity of the protected information...

Active Exploitation of ZK Framework CVE-2022-36537

Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. Rapid7 is aware of active exploitation of CVE-2022-36537 in vulnerable versions of ConnectWise R1Soft Server Backup Manager software. The root cause of the vulnerability is an...

CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation. Tracked as CVE-2022-36537 CVSS score: 7.5, the issue impacts ZK Framework versions...