JEP290_RMI_Bypass

Cos'è questo? Questo progetto è per lo studio del JEP290 Bypass Risultato...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2023-32571-POC

Dynamic-Linq-Injection zu RCE - CVE-2023-32571 Über Dynamic-Linq-Injection zu RCE CVE-2023-32571 Vor Kurzem entdeckten Mitglieder der NCC Group eine Schwachstelle in Dynamic Linq, die es Angreifern ermöglicht, C-Funktionen über eine Linq-Injection aufzurufen und so RCE zu erlangen. Trotz des...

RmiTaste

RmiTaste RmiTaste consente ai professionisti della sicurezza di rilevare, enumerare, interagire e attaccare servizi RMI chiamando metodi remoti con gadget di ysoserial. Permette inoltre di chiamare metodi remoti con parametri specifici. Dichiarazione di non responsabilità RmiTaste è stato scritto...

CVE-2022-41853

Ricerca su CVE-2022-41853: Utilizzo di funzioni statiche per ottenere RCE tramite deserializzazione Java e attacco Remote Codebase Coloro che utilizzano java.sql.Statement o java.sql.PreparedStatement in hsqldb HyperSQL DataBase per elaborare input non attendibili potrebbero essere vulnerabili a ...

TerraMaster-TOS-CVE-2020-15568

TerraMaster TOS CVE-2020-15568 Repository per il modulo Metasploit di CVE-2020-15568 Applicazione Vulnerabile Descrizione Una vulnerabilità di invocazione dinamica di metodi di classe esiste nel file include/exportUser.php che porta all'esecuzione di comandi remoti sui dispositivi TerraMaster con...

CVE-2018-3245

CVE-2018-3245 Passo 1 java -jar ysoserial-cve-2018-3245.jar root@kitploit: WHY SO SERIAL? Usage: java -jar ysoserial-cve-2018-3245.jar payload 'command' Available payload types: Payload Authors Dependencies ------- ------- ------------ CVE201828931 @mbechler CVE201828932 @mbechler CVE201828933...

CVE-2025-27636-demo

Demonstração de CVE do Apache Camel Este projeto demonstra vulnerabilidades de segurança no Apache Camel relacionadas a ataques de injeção de cabeçalho. Build Docker Crie a imagem Docker: root@kitploit: docker build -t camel-cve-demo . Execução Docker Execute o contêiner com todas as portas...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Template Nuclei Template di rilevamento non distruttivo Nuclei per CVE-2026-19478 , una vulnerabilità critica CVSS 9.4 di invocazione arbitraria di metodi non autenticata nell'API GraphQL di GitLab, corretta da GitLab il 17 agosto 2026. In breve Lo schem...

gitlab-cve-2026-19478-lab

CVE-2026-19478 — GitLab GraphQL @glintroduced: nicht authentifizierter Aufruf beliebiger Methoden Validierungslabor + PoC Reproduzierbares A/B-Labor und sicherer PoC für CVE-2026-19478 GitLab CE/EE, CVSS 9.4, Kritisch. Ein nicht authentifizierter Angreifer kann beliebige 0-Argument-Ruby-Methoden...

PT-2026-76556

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description An issue exists where the backend fails to validate the handler name submitted via the handler POST field during form postbacks. While AJAX requests are validated against the onA-Zw+ pattern, the...

Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance

Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...

CVE-2026-69088

Grav CMS 2.0.7–2.0.10 is affected by an arbitrary method invocation vulnerability in blueprint dynamic-field directives. The issue arises because Blueprint::isSafeDynamicCall() only applies its denial list to strings without '::', allowing an account with page-editing rights to insert a directive...

GHSA-FQ3F-M5QM-99F5 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive...

EUVD-2026-46728

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise...

CVE-2026-60313

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise...

CVE-2026-54712

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...

CVE-2026-54712

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...

CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...

CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...