alibaba__one-java-agent_CVE-2022-25842_0-0-1

one-java-agent Goals 1. Provide plugin support to centrally manage multiple Java Agents. 2. Plugins support install/uninstall, requiring the plugin to implement interfaces. 3. Support traditional Java agents, i.e., already developed Java agents. Plugin System If a plugin wishes to be aware of the...

WebLogic-Shiro-shell

Java Deserialization Technology Sharing This sharing covers the following points: 1. Java Serialization and Deserialization Basics 2. Why do vulnerabilities occur during deserialization? 3. Java Reflection 4. ysoserial CommonsCollections2, CommonsCollections5 5. Java ClassLoader: Several methods...

CVE-2020-6287_RECON-scanner

Vulnerability Assessment and Indicator of Compromise IoC Scanner for CVE-2020-6287 RECON RECON Remotely Exploitable Code On NetWeaver is a critical CVSSv3 10 vulnerability affecting a number of SAP business and technical applications running on top of the SAP NetWeaver Java stack. This...

web-inf-path-trav

WebXMLExp.py Tool for helping in the exploitation of path traversal vulnerabilities in Java web applications. This tool is referenced in the Invicti Security white paper Exploiting path traversal vulnerabilities in Java web applications. Install Python3 is required for this tool. Run the followin...

CVE-2022-34169

Description Checks if CVE-2022-34169 is fixed on your machine. As far as I know, an exploit was found by a Google employee and not published. Since the fix is known, a small test routine was written with this to check whether the fix is available at runtime. Build yourself optional Optional: This...

CVE-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36...

ROOT-APP-MAVEN-CVE-2026-106451 CVE-2026-106451 in at.yawk.lz4:lz4-java - Patched by Root

Root has patched CVE-2026-106451 in the at.yawk.lz4:lz4-java package for Root:Maven. Multiple fixed versions available...

test-44228

test-44228 A simple example for CVE-2021-44228 Implements two java CLIs, one using log4j v1.x, the other using log4j 2.x to demonstrate the log4shell vulnerability. See also: https://www.lunasec.io/docs/blog/log4j-zero-day/ https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Usage...

mjet

mjet Mogwai Security Java Management Extensions JMX Exploitation Toolkit mjet is a tool that can be used to protect insecure configured JMX services. It is based on the blog post "Exploiting JMX-RMI" from Braden Thomas/Accuvant "http://www.accuvant.com/blog/exploiting-jmx-rmi" and can be used to...

CVE-2020-12116

CVE-2020-12116 Proof of concept code to exploit CVE-2020-12116: Unauthenticated arbitrary file read on ManageEngine OpManger. Summary The latest release of OpManger contains a directory traversal vulnerability that allows unrestricted access to every file in the OpManager application. This includ...

ff4j__ff4j_CVE-2022-44262_1_8_13_fixed

✨✨✨ FF4J - Feature Flipping for Java ✨✨✨ Codacy Badge FF4j, is an implementation of the Feature Toggle pattern. 🤘Features Feature Toggle: Enable. and disable features at runtime - no deployments. In your code implement multiple paths protected by dynamic predicates if/then/else. Role-based...

lua-ffi-libinjection

Name lua-resty-libinjection - LuaJIT FFI bindings for libinjection Status This library is in active development and is production ready Description This library provides FFI bindings for libinjection, a SQL/SQLi and XSS tokenizer and analyzer. Installation Install this library as you would any...

fabric8io__kubernetes-client_CVE-2021-4178_5-0-2

Kubernetes & OpenShift Java Client This client provides access to the full Kubernetes & OpenShift REST APIs via a fluent DSL. kubernetes-client: kubernetes-model-core: openshift-client: knative-client: !Maven Centralhttps://img.shields.io/m...

XStream-1

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...

CVE-2022-21449-showcase

Demo program to showcase CVE-2022-21449 Pls run with JDK 17.0.0 O yeah here is screenshot...

CVE-2016-4463

CVE-2016-4463 An implementation of the CVE-2016-4463 exploit. Xerces 3.1.3 and below exploit. I meant to get this submitted to Exploit-DB, but I do not have a good go-to app to test this against. Java OpenSAML should be vulnerable, but it will take some time to explore this...

CVE-2024-21683-RCE

CVE-2024-21683-RCE Credit https://x.com/realalphaman https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated Usage git clone https://github.com/W01fh4cker/CVE-2024-21683-RCE cd CVE-2024-21683-RCE pip install requests bs4 python CVE-2024-21683.py -u...

async-http-client-check

async-http-client-check Offline checker for the 26 repository-level security advisories oforg.asynchttpclient:async-http-client AsyncHttpClient, "AHC". It tells you which ones your jar is actually exposed to, flags the ones Dependabot and OSV cannot see , and gives one answer per line: 3.x →3.0.1...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Pre-authentication Remote Code Execution in OpenIdentityPlatform OpenAM = 16.0.5 via unsafe Java deserialization of the jato.clientSession parameter CVSS 9.8. For authorized security testing only. Quick Start 1. Build payload downloads JARs from Maven Central ...

BetterBackdoor

BetterBackdoor A backdoor is a tool used to gain remote access to a machine. Typically, backdoor utilities such as NetCat have two main functions: to pipe remote input into cmd or bash and output the response. This is useful, but it is also limited. BetterBackdoor overcomes these limitations by...