oracleShell

oracleShell Oracle Database Command Execution Test Environment - DBA Privileges: SELECT FROM v$version Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production PL/SQL Release 11.2.0.1.0 - Production "CORE 11.2.0.1.0 Production" TNS for 32-bit Windows: Version 11.2.0.1.0 - Production...

vbox-guestctrl-copyfrom-dotdot

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vbox-guestctrl-copyfrom-dotdot vbox-guestctrl-copyfrom-dotdot Class: File write Reach: Local guest confused-deputy Oracle VM VirtualBox OSS 7.2.20 f2792cf44 - Oracle Host IGuestSession::directoryCopyFromGuest /...

CVE-2020-14882

CVE-2020-14882 This Python script is designed to exploit a Remote Code Execution vulnerability in Oracle WebLogic Server CVE-2020-14882 to execute commands on a vulnerable target server and capture their output through HTTP requests. It first prompts for a target WebLogic URL and network interfac...

CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit for CVE-2026-89012: the forbidden-fields denylist in forgeSQLFromUniversalSearchCriteria introduced with the CVE-2026-71510 fix uses a case-sensitive inarray while the operand charset allows A-Z. Since SQL column resolution is...

CVE-2017-3241-POC

CVE-2017-3241-POC POC for java RMI deserialization vulnerability You probably need to use JDK 8 to run this poc. Just pay attention to Message class in both client and server side. They are different. And the difference is the key to understand this vulnerability. The fix Oracle published is to...

CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

CVE-2026-71456

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20...

snowpick

snowpick is a ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data exposure. ServiceNow exposes data through two common public surfaces: Service Portal widgets and the Table REST API. When access controls on either surface are...

CVE-2017-10271

CVE-2017-10271 identification and exploitation. Unauthenticated Weblogic RCE. https://nvd.nist.gov/vuln/detail/CVE-2017-10271 https://www.oracle.com/technetwork/topics/security/cpuoct2017-3236626.html POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: SOMEHOSTHERE Content-Length: 1226 content-type...

CVE-2020-14882

CVE-2020-14882 This script enables remote code execution RCE on Oracle WebLogic Server using an unauthenticated GET request. It exploits the vulnerability CVE-2020-14882. By executing arbitrary commands, an attacker can gain unauthorized access to the server. Exploit Details Exploit Title: Oracle...

CVE-2020-14883

CVE-2020-14883 Oracle WebLogic Server Authenticated Remote Code Execution RCE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily...

CVE-2020-14882

CVE-2020-14882 CVE-2020-14882 Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows...

CVE-2026-71456

The Johnson Controls Kantech Entrapass software (versions before 9.20 ) is vulnerable to a Padding Oracle Crypto Attack due to the use of hard-coded cryptographic keys (CWE-321). The high-severity vulnerability allows for potential impact on confidentiality, integrity, and availability. No specif...

EUVD-2026-109980

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20...

Oracle-WebLogic-CVE-2017-10271

Oracle-WebLogic-CVE-2017-10271 WebLogic wls-wsat RCE CVE-2017-10271 Vulnerability Description In the early days, hackers exploited the WLS component vulnerability of WebLogic to launch large-scale remote attacks against enterprise servers. A large number of enterprise servers were compromised, an...

rbndr

rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...

CVE-2018-3245

Weblogic-CVE-2018-3245 CVE-2018-3245 0x00 Introduction On October 16 local time, and in the early hours of October 17 Beijing time, Oracle officially released the October Q3 Critical Patch Update CPU, which fixed a Weblogic remote code execution vulnerability CVE-2018-2893 that was not fully...

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical- Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in has an easily exploitable, unauthenticated, network-reachable flaw allowing compromise over HTTP. Affected supported versions include 12.2.1.4.0,...

odat

Quentin HARDY --- [email protected] [email protected] ODAT ODAT Oracle Database Attacking Tool is an open source penetration testing tool that tests the security of Oracle Databases remotely. Usage examples of ODAT: You have an Oracle database listening remotely and want to find valid...

CVE-2026-21962

🔥 CVE-2026-21962 — Oracle HTTP Server Detection Toolkit Safe, non-exploitative detection tools for identifying Oracle HTTP Server and WebLogic Proxy Plug-in instances affected by CVE-2026-21962. 🧠 Vulnerability Overview CVE: CVE-2026-21962 Severity: Critical Attack Vector: Network Authentication...