JEP290_RMI_Bypass

이게 뭐지? 이 프로젝트는 JEP290 Bypass 연구를 위한 것입니다. 결과...

TerraMaster-TOS-CVE-2020-15568

TerraMaster TOS CVE-2020-15568 CVE-2020-15568 Metasploit 模块仓库 受影响应用 描述 文件 include/exportUser.php 中存在一个动态类方法调用漏洞，可在 TerraMaster 设备上以 root 权限执行远程命令。 该漏洞文件需要提供几个 HTTP GET 参数，才能到达方法调用并利用此漏洞。在第一行，应用包含了 app.php，它会自动加载 TOS 软件的相关核心类。 应用根据 GET 参数 type 的值来决定操作。如果 type 变量的值不是 1 或 2，则可能到达易受攻击的代码。 查看...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

RmiTaste

RmiTaste RmiTaste는 보안 전문가가 ysoserial의 gadget을 사용하여 원격 메서드를 호출함으로써 RMI 서비스를 탐지, 열거, 상호 작용 및 공격할 수 있게 해줍니다. 또한 특정 매개변수로 원격 메서드를 호출할 수도 있습니다. 면책 조항 RmiTaste는 사용자가 사전 승인을 받은 시스템에서 안전하지 않은 RMI 서비스를 식별하는 보안 전문가를 돕기 위해 작성되었습니다. 컴퓨터 시스템에 대한 무단 접근은 불법이며, RmiTaste는 모든 관련 법률을 준수하여 사용해야 합니다. 이를 위반할 경우 기소될 수...

CVE-2018-3245

CVE-2018-3245 Step 1 java -jar ysoserial-cve-2018-3245.jar root@kitploit: WHY SO SERIAL? Usage: java -jar ysoserial-cve-2018-3245.jar payload 'command' Available payload types: Payload Authors Dependencies ------- ------- ------------ CVE201828931 @mbechler CVE201828932 @mbechler CVE201828933...

CVE-2023-32571-POC

Dynamic Linq インジェクションによる RCE - CVE-2023-32571 Dynamic Linq インジェクションによる RCE について（CVE-2023-32571） 最近、NCC Group のメンバーが Dynamic Linq の脆弱性を発見しました。この脆弱性により、攻撃者は Linq インジェクションを介して C 関数を呼び出し、RCE を達成できる可能性があります。 Dynamic Linq に関する RCE の報告があったにもかかわらず、NCC Group のメンバーはなぜかコマンド実行用の POC を公開しませんでした。 POC NCC Group...

CVE-2026-19478

-b91c1c?style=flat-square CVE-2026-19478 — Nuclei Template Non-destructive Nuclei detection template for CVE-2026-19478 , a critical CVSS 9.4 unauthenticated arbitrary method invocation flaw in the GitLab GraphQL API, patched by GitLab on August 17, 2026. TL;DR GitLab's GraphQL schema supports a...

CVE-2025-27636-demo

Apache Camel CVE Demonstration This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks. Docker Build Build the Docker image: root@kitploit: docker build -t camel-cve-demo . Docker Run Run the container with all necessary ports: root@kitploit: docker...

CVE-2022-41853

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default ...

gitlab-cve-2026-19478-lab

CVE-2026-19478 — GitLab GraphQL @glintroduced unauthenticated arbitrary-method-invocation validation lab + PoC Reproducible A/B lab and safe PoC for CVE-2026-19478 GitLab CE/EE, CVSS 9.4, Critical. An unauthenticated attacker can invoke arbitrary 0-argument Ruby methods on GraphQL-resolved domain...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: RMI. The supported versions affected by this vulnerability are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM fo...

PT-2026-76556

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description An issue exists where the backend fails to validate the handler name submitted via the handler POST field during form postbacks. While AJAX requests are validated against the onA-Zw+ pattern, the...

Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance

Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...

CVE-2026-69088

Grav CMS 2.0.7–2.0.10 is affected by an arbitrary method invocation vulnerability in blueprint dynamic-field directives. The issue arises because Blueprint::isSafeDynamicCall() only applies its denial list to strings without '::', allowing an account with page-editing rights to insert a directive...

GHSA-FQ3F-M5QM-99F5 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive...

VulnCheck KEV: CVE-2016-3081

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...

EUVD-2026-46728

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise...

CVE-2026-60313

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise...

CVE-2026-54712

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...

CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...