The vulnerability of the WLS component – the Web Services server of the J2EE application servers from Oracle WebLogic Server – allows attackers to gain access to confidential information.

The vulnerability of the WLS component—the Web Services server for J2EE applications—in Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information from a remote location...

The vulnerability of the WLS component – the Web Services server of the J2EE application servers from Oracle WebLogic Server – allows attackers to gain access to confidential information.

The vulnerability of the WLS component—the Web Services server for J2EE applications—in Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information from a remote location...

The vulnerability of the WLS component – the Web Services server of the J2EE application servers from Oracle WebLogic Server – allows attackers to gain access to confidential information.

The vulnerability of the WLS component—the Web Services server for J2EE applications—in Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information from a remote location...

The vulnerability of the WLS component – the Web Services server of the J2EE application servers from Oracle WebLogic Server – allows attackers to gain access to confidential information.

The vulnerability of the WLS component—the Web Services server for J2EE applications—in Oracle WebLogic Server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information from a remote location...

Exploit for Injection in Oracle Agile_Plm

CVE-2019-2725 CVE-2019-2725 CNVD-C-2019-48814; WebLogic wls...

Oracle Application Testing Suite - WebLogic Server Administration Console War Deployment (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Application Testing Suite WebLogic Server Administration Console War Deployment', 'Description' = %q This module abuses a feature in...

Oracle Application Testing Suite WebLogic Server Administration Console War Deployment Exploit

This Metasploit module abuses a feature in WebLogic Server's Administration Console to install a malicious Java application in order to gain remote code execution. Authentication is required, however by default, Oracle ships with a "oats" account that you could log in with, which grants you...

Oracle Application Testing Suite WebLogic Server Administration Console War Deployment

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Application Testing Suite WebLogic Server Administration Console War Deployment', 'Description' = %q This module abuses a feature in...

Oracle Fusion Middleware Information Disclosure (CVE-2019-2615)

An information disclosure vulnerability exists in Oracle WebLogic Server component of Oracle Fusion Middleware. Successful exploitation could result in the disclosure of sensitive information...

U.S. Dept Of Defense: RCE on █████ via CVE-2017-10271

Summary: Happy Friday! The server at ██████ is vulnerable to CVE-2017-10271 "Oracle WebLogic Server Remote Command Execution". Description: The following request takes 12 seconds 12000 milliseconds to complete: POST /wls-wsat/RegistrationPortTypeRPC HTTP/1.1 Host: ██████████ Content-Length: 423...

Threat Source newsletter (May 9)

Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. If you haven’t yet, there’s still time to register for this year’s Talos Threat Research Summit — our second annual conference by...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

PoC exploit for CVE-2017-10271, an RCE vulnerability in Oracle WebLogic. The exploit targets the async/AsyncResponseService endpoint and uses a SOAP request to inject malicious code. The payload is a Java XMLDecoder that creates a ProcessBuilder to execute a bash shell with a reverse shell payloa...

Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Weblogic Server Deserialization RCE - AsyncResponseService ', 'Description' = %q An unauthenticated attacker with network access to the...

The vulnerability of the WLS9_ASYNC and WLS-WSAT component of the Oracle WebLogic Server allows a hacker to execute arbitrary code and take control of the target system.

The vulnerability of the WLS9ASYNC and WLS-WSAT component of the Oracle WebLogic Server application server is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and gain control over the target system...

Oracle Weblogic Server Deserialization Remote Code Execution Exploit

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a malicious SOAP request to the interface WLS AsyncResponseService to execute code on the vulnerable host. This module requires Metasploit: https://metasploit.com/download Current source:...

Oracle Weblogic Server Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Weblogic Server Deserialization RCE - AsyncResponseService ', 'Description' = %q An unauthenticated attacker with network access to the...

Oracle WebLogic Exploit-fest Continues with GandCrab Ransomware, XMRig

Malicious activity exploiting the recently disclosed Oracle WebLogic critical deserialization vulnerability CVE-2019-2725 is surging. Even though there’s a patch, tens of thousands of vulnerable machines represent an irresistible target for hackers, according to Unit 42 researchers at Palo Alto...

Exploit for CVE-2019-2618

CVE-2019-2618 – Vulnerability Detection Tool Enter the serve...

Exploit for CVE-2013-0422

K8tools 20190428 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 博客: https://www.cnblogs.com/k8gege 下载: https://github.com/k8gege/K8tools PS: 不定期更新,文件比较大，可按需下载。工具有BUG或建议可直接Github上留言 提权工具均可在远控Cmd或WebShell运行，大部份经过修改编译兼容性稳定性更好 注意：不保证永久有效,喜欢自行保存。 综合工具 + 综合工具 K8飞刀Final.rar + K8data.mdb K8飞刀漏洞数据库20190402 + K8expList.txt...

Oracle Fusion Middleware Remote Code Execution (CVE-2019-2618)

A remote code execution vulnerability exists in Oracle WebLogic Server component of Oracle Fusion Middleware. Successful exploitation of this vulnerability could lead to remote code execution on the target server...