CVE-2020-14820

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T...

CVE-2020-14757

CVE-2020-14757 affects Oracle WebLogic Server (Fusion Middleware Web Services) 12.2.1.3.0. The vulnerability allows an unauthenticated, network-accessible attacker via HTTP to compromise WebLogic Server; successful exploitation requires human interaction and can lead to unauthorized data creation...

PT-2020-4570

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 Description The issue is related to insufficient input validation in the Console component of Oracle WebLogic Server, allowing a remote attacker to gain full control over the...

CVE-2020-14883 — Authenticated RCE in Console component of Oracle WebLogic Server

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP...

PT-2020-4551

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 10.3.6.0.0 through 14.1.1.0.0 Description A vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console allows an unauthenticated attacker with network access via HTTP to...

CVE-2020-14882 — Unauthenticated RCE in Console component of Oracle WebLogic Server

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP...

Security Bulletin: IBM Jazz for Service Management (JazzSM) is affected with multiple vulnerabilities (CVE-2015-4852, CVE-2015-6420, CVE-2017-15708)

Summary Jazz for Service Management is affected with multiple vulnerabilities CVE-2015-4852, CVE-2015-6420, CVE-2017-15708 Vulnerability Details CVEID: CVE-2017-15708 DESCRIPTION: In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse...

Weblogic_CVE_2019_2729 Command Execution Vulnerability on Huawei Software Technology Co. website

http://122.112.190.83:8080/wls-wsat/CoordinatorPortType11...

Oracle WebLogic Server Administration Console Handle RCE

This module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against 12.2.1.3.0...

VulnCheck KEV: CVE-2015-4852

Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution...

Command Execution Vulnerability in Oracle WebLogic Console (CNVD-2020-59803)

WebLogic Server is Oracle's JavaEE-based middleware for developing, integrating, deploying and managing large-scale distributed Web applications, web applications and database applications. A command execution vulnerability exists in Oracle Weblogic Server. An attacker can exploit the vulnerabili...

Exploit for CVE-2020-2883

CVE-2020-2883 re write of...

The vulnerability of the weblogic/oracle-aqjms component of the Jackson-databind library in the FasterXML project allows a attacker to execute arbitrary code.

The vulnerability of the weblogic/oracle-aqjms component of the Jackson-databind library in the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Exploit for CVE-2018-2894

Weblogic CVE-2018-2894 CVE-2018-2894 0x01 前言 Oracle 7月更新中，修复了Weblogic Web Service Test Page中一处任意文件上传漏洞，Web Service Test Page 在“生产模式”下默认不开启，所以该漏洞有一定限制， 利用该漏洞，可以上传任意jsp文件，进而获取服务器权限。 0x02 漏洞环境 Ubuntu 16.04 https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2894/ 执行如下命令，启动weblogic 12.2.1....

Exploit for CVE-2018-2894

Weblogic任意文件上传漏洞（CVE-2018-2894） 最近大家都在说这个漏洞，大家都注意到config.do这里发生了问题，但是其实根据 https://mp.weixin.qq.com/s/y5JGmM-aNaHcs6P9a-gRQ 这里的信息，begin.do也是有问题。少扯淡，下面给出具体利用方法： 问题就出现下下面这个页面。 上传时候，修改name的值就可以了 避免大家麻烦，给出来： /../../../../../../wlserver/server/lib/consoleapp/webapp/framework/skins/wlsconsole/images/ 然后...

Exploit for CVE-2018-2894

CVE-2018-2894 CVE-2018-2894 WebLogic 未授权访问致任意文件上传/RCE漏洞 检查脚本...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 WebLogic反序列化漏洞复现 weblogic getshell python CVE-2018-2628-Getshell.py ip port shell1.jsp C:\Users\CTF\Desktoppython CVE-2018-2628-Getshell.py 10.10.20.166 7001 jason1.jsp / \ \ / / | | \ / / |/ \ | \ / /| \ / \ | | \ \ / /| | | | | || | | / / | | | | \ / / | |/ /| | | || | usage:...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 CVE-2018-2628漏洞工具包 根据Github上整理出的漏洞利用工具包含： 1.CVE-2018-2628漏洞检测工具 //漏洞存在检测的POC 2.weblogicpoc.py //漏洞利用的POC 3.ysoserial-0.1-cve-2018-2628-all.jar //借鉴的漏洞利用工具https://github.com/tdy218/ysoserial-cve-2018-2628/releases 具体的漏洞复现过程请移步简书：https://www.jianshu.com/p/6649118ba7b6...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

This is a PoC exploit for CVE-2017-10271, a vulnerability in Oracle WebLogic's wls-wsat component that allows for deserialization of untrusted data, leading to remote code execution. The exploit is written in Python and uses the requests library to send a malicious XML payload to the vulnerable...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

PoC exploit for CVE-2017-10271, an unauthenticated Weblogic RCE. The target product/service is Weblogic, and the vulnerability class/vector is RCE Remote Code Execution. The probable entry point is the CoordinatorPortType SOAP endpoint. Notable dependencies/tooling include the requests library an...