5361 matches found
Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution. id: CVE-2025-5086 info: name: Dassault Systèmes DELMIA Apriso up to 2025 - Insecure Deserialization author: hacktronai,iamnoooob,pdresearch...
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...
XStream <1.4.17 - Remote Code Execution
XStream before 1.4.17 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of...
CVE-2026-40473
camel-mina MinaConverter.toObjectInput Unsafe Deserialization Reproducer CVE-2026-40473 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-mina component, tracked as CVE-2026-40473. The MinaConverter.toObjectInputIoBuffer type converter wraps the received bytes...
CVE-2023-38035-MobileIron-RCE
MobileIron CVE-2023-38035 Exploit README.md Description This bash script automates the process of scanning for vulnerable MobileIron systems that are susceptible to the CVE-2023-38035 exploit. The script performs multiple checks, including checking for required programs, downloading potential...
zkar
ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...
CVE-2016-0792
Exploit for Jenkins serialization vulnerability - CVE-2016-0792 https://www.exploit-db.com/exploits/42394/ More information can be found here 1. Contrast Security 2. Pentester Lab Requirements 1. Python 3.6.x 2. requests library is required for this exploit to work sudo pip install requests Usage...
CVE-2020-36188
Description FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource How to RCE pom.xml com.fasterxml.jackson.core jackson-databind 2.9.10.7...
CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-
Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...
CVE-2026-33725
CVE-2026-33725 A proof-of-concept exploit for CVE-2026-33725, a Remote Code Execution and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import in Metabase. Vulnerable Versions Metabase Enterprise ≥ v1.47 and v1.54.22 Metabase Enterprise ≥ v1.54.0 and v1.54.22 Metabase...
LeakValue
Android 13 introduces many enhancements in order to harden Parcel serialization mechanism Here's presentation from Android Security and Privacy team on enhancements made That is great, definitely eliminates or makes unexploitable many vulnerabilities. Also they describe breaking my previous...
pbtk
pbtk - Reverse engineering Protobuf apps Protobuf is a serialization format developed by Google and used in an increasing number of Android, web, desktop and more applications. It consists of a language for declaring data structures , which is then compiled to code or another kind of structure...
javajive
JavaJive English | 简体中文 | Website A portable, pure-Go Java toolkit — extracted and trimmed from yaklang — that does three things and nothing else: Decompile — .class / .jar / .war / .zip → readable Java source. Parse classes — inspect the structure of a .class file constant pool, fields, methods,...
serialization-vulnerability-scanner
This repository does not have a README...
CVE-2021-43297-POC
CVE-2021-43297 Vulnerability Description Apache Dubbo Hessian-Lite 3.2.11 and earlier versions contain a potential RCE attack risk. When Hessian-Lite encounters a serialization exception, it outputs related information, which may trigger the toString method of certain maliciously crafted Beans,...
sobelow
Sobelow Sobelow is a security-focused static analysis tool for Elixir & the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent the introduction of a number of common vulnerabilities...
XStream-1
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...
CVE-2020-36179
Description CVE-2020-36179： FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. CVE-2020-36180： FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the...
CVE-2023-34040
CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36...