CVE-2023-34040

CVE-2023-34040 Spring Kafka 反序列化远程代码执行 root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36 Accept:...

XStream-1

master: v-1.4.x: XStream Java 与 XML 之间的序列化，以及反向转换 Binaries 所有二进制构件都打包在 -bin 归档中。它包含 XStream 的 jar 文件以及构建时使用的任何其他库，或可选的运行时附加组件。建议使用 Xpp3，因为它将大幅提升 XStream 的性能。 Documentation 文档可在 GitHub 上找到。包括： 简介 和 教程 JavaDoc 变更历史 常见问题 Source XStream 的完整源代码打包在 -src 归档中。包括： 主 API xstream/src/java 单元测试...

zkar

ZKar ZKar 是一款使用 Go 实现的 Java 序列化协议分析工具。该工具仍处于 开发中 阶段，因此尚无完整的 API 文档和贡献指南。 ZKar 提供： 纯 Go 编写的 Java 序列化 payload 解析器和查看器，无需 CGO 或 JDK 从 Java 序列化协议到 Go 结构体的转换 一个可操作 Java 序列化数据的 Go 库 开发中：用 Go 实现 ysoserial 开发中：Java 类字节码的解析、查看和操作 开发中：Go 实现的 RMI/LDAP 📦 安装 ZKar 的使用很简单。使用 go get 安装 ZKar 及其库和依赖： root@kitploit...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

x-stream__xstream_CVE-2021-21345_1-4-15

master: v-1.4.x: XStream Serialización de Java a XML, y viceversa Binarios Todos los artefactos binarios están incluidos en el archivo -bin. Incluye los jars de XStream y cualquier otra biblioteca utilizada en tiempo de compilación, o extras opcionales en tiempo de ejecución. Se recomienda el uso...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java 与 XML 序列化，以及反向转换 二进制文件 所有二进制构件都打包在 -bin 压缩包中。其中包括 XStream 的 jar 包以及构建时使用或可选的运行时扩展库。建议使用 MXParser，因为它能大幅提升 XStream 的性能。 文档 文档可在 GitHub 查阅。内容包括： 简介 和 教程 JavaDoc 变更历史 常见问题解答 安全性 源代码 XStream 的完整源代码打包在 -src 压缩包中。包括： 主 API xstream/src/java 单元测试 xstream/src/test Maven 构建文件...

CVE-2020-9496

CVE-2020-9496 - RCE 由于webtools中的两个与xmlrpc相关的请求（xmlrpc和ping）未使用身份验证，因此它们容易受到不安全反序列化的攻击。GitHub安全实验室团队的Alvaro Munoz [email protected]已将此问题报告给安全团队。 此漏洞是由于处理发送到/webtools/control/xmlrpc的请求时的Java序列化问题而存在的。远程未认证攻击者可以通过发送精心构造的请求来利用此漏洞。成功利用将导致任意代码执行。 受影响版本 17.12.01 修复版本 18.12.01, 17.12.04...

cve-2023-34040

CVE-2023-34040 Spring Kafka 反序列化远程代码执行 root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36 Accept:...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput Reproductor de deserialización insegura CVE-2026-40473 Este proyecto demuestra una vulnerabilidad de deserialización en Java en el componente camel-mina de Apache Camel, registrada como CVE-2026-40473. El convertidor de tipos...

x-stream__xstream_CVE-2013-7285_1-4-6

XStream root@kitploit: “Java 到 XML 序列化，再返回” -- 二进制文件 ----------------------------------------------- 所有二进制工件都位于“lib”目录中。其中包括 xstream jar 包以及构建时使用的任何其他库， 或可选的运行时附加组件。建议使用 kXML2，因为它能 极大地提升 XStream 的性能。 -- 文档 -------------------------------------------------- 文档可在 docs/index.html 中找到。其中包含： 简介与教程...

javaserializetools

This repository does not have a README...

Astra Linux – Vulnerability in libxstream-java

XStream is an open-source Java library for serializing objects to XML and back. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% of the CPU time on the target system, depending on the CPU type or through parallel execution of such operations. This can lead to a denial of...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

GHSA-XWW8-MXQW-M84W Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

PT-2026-55883

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in...

PT-2026-55884

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Control of Generation of Code ('Code Injection') (CVE-2026-27830)

Summary There are vulnerabilities in c3p0-0.9.5.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-27830. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via...