GadgetProbe

Descrizione Hai appena trovato un bug di deserializzazione Java, hai eseguito tutti i tuoi payload ysoserial e... non hai ottenuto nulla. E adesso? Come puoi fare debug o costruire una catena di gadget se sei completamente cieco? Ecco GadgetProbe, uno strumento che fa luce sui classpath remoti e...

Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform

JBoss Deserialization RCE CVE-2017-12149 Vulhubhttps://v...

RHLW-2026-CD97E66695607070 Lightwell Security Advisory: xalan-bcel-6.6.1 2.7.2.Final-rhlw-00004

Red Hat Lightwell has released xalan:xalan-bcel-6.6.1 2.7.2.Final-rhlw-00004 with a backported security fix. CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets This patched artifact is a drop-in replacement for...

RHLW-2026-A06FD4CFDAB7EF70 Lightwell Security Advisory: spring-aop 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-aop 5.3.18.rhlw-00010 with a backported security fix. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data. Depending on how t...

RHLW-2026-26042322A4C88B7D Lightwell Security Advisory: protobuf-java-util 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-java-util 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-java-util 3.21.7 from Maven Central...

RHLW-2026-C9A2C76071C97E3C Lightwell Security Advisory: protobuf-java 3.21.7.rhlw-00002

Red Hat Lightwell has released com.google.protobuf:protobuf-java 3.21.7.rhlw-00002 with a backported security fix. CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-java 3.21.7 from Maven Central...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus

Summary Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus have been addressed. Vulnerability Details CVEID:CVE-2026-47057 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...

EUVD-2026-94589

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader Bypass of CVE-2024-53990 Fix...

rogue-jndi

Rogue JNDI Ein bösartiger LDAP-Server für JNDI-Injection-Angriffe. Beschreibung Das Projekt enthält LDAP- und HTTP-Server zum Ausnutzen der standardmäßig unsicheren Java-JNDI-API. Um einen Angriff durchzuführen, kannst du diese Server lokal starten und dann eine JNDI-Auflösung auf dem verwundbare...

Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in IBM Semeru (July 2026 CPU)

Summary There are vulnerabilities in IBM Runtime Environment Java™ Version 8.0.8.65 and earlier, and IBM Semeru Version 21.0.11.0 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in July 2026. Vulnerability Details CVEID:CVE-2026-46917 DESCRIPTION:...

marshalsec

Java Unmarshaller Security - Trasformare i tuoi dati in esecuzione di codice Se sei arrivato qui per Log4Shell/CVE-2021-44228, potresti voler leggere i vettori di sfruttamento e le versioni del runtime Java interessate: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ Paper Sono...

Legion of the Bouncy Castle: The Bouncy Castle Crypto Package for Java – Encryption Problem Vulnerabilities

Legion of the Bouncy Castle: The Bouncy Castle Crypto package has vulnerabilities for versions of Java 2.73.13 and earlier. This vulnerability stems from the native one-time CTR block cipher not checking whether the input length exceeds the counter’s remaining space after the Initial Value IV. As...

text4shell-poc

Aplicación de Prueba PoC para CVE-2022-42889 Esta es una aplicación vulnerable desarrollada como Prueba de Concepto para la vulnerabilidad CVE-2022-42889. Instalación con Maven Para ejecutarlo necesitarás: JDK 17 o superior Maven 1. Clona el repositorio git git clone...

log4j_checker_beta

log4jcheckerbeta - Scripts para Linux, macOS y Windows Si deseas usar los cradles de descarga de Windows/Linux a continuación, revisa los scripts de antemano. Cargar código de internet y ejecutarlo es lo que nos trajo aquí con Log4Shell, ¿verdad? ;- Servidores o clientes Linux y macOS El script...

CLEANSTART-2026-JU40621 attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container

Security vulnerability affects the apache-hive package. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container...

CLEANSTART-2026-HR57844 There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads

Security vulnerability affects the apache-hive package. There's a vulnerability within the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads...

CLEANSTART-2026-UB44506 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-VM57227 Those using java

Security vulnerability affects the apache-hive package. Those using java...

CLEANSTART-2026-WR59127 Apache Xerces2 Java Parser before 2

Security vulnerability affects the apache-hive package. Apache Xerces2 Java Parser before 2...

CLEANSTART-2026-YS57546 ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java

Security vulnerability affects the apache-hive package. ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java...