wildPwn

wildPwn - WildFly エクスプロイトツール WildFly用のツールです。ブルートフォース攻撃やシェルデプロイに使用できます。 wildPwn.war には修正されたLaudanum Shellが含まれています。 userList.txt には一般的なユーザー名、 passList.txt には一般的なパスワードが含まれています。 使用方法 ブルートフォース python wildPwn.py -m brute --target -user -pass シェルデプロイ python wildPwn.py -m deploy --target --port -u -p 詳細...

CLEANSTART-2026-WN90580 flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature

Security vulnerability affects the apache-hive package. A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature...

CLEANSTART-2026-NF19276 Improper certificate validation in Apache MINA SSHD (server-side)

Security vulnerability affects the wildfly package. Improper certificate validation in Apache MINA SSHD server-side...

CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final ベースイメージ — CVE-2025-12543 パッチ 概要 このリポジトリは、WildFly 11.0.0.Final 上に構築された Docker ベースイメージを提供し、Undertow における深刻な Host ヘッダ検証の脆弱性 CVE-2025-12543 に対するバックポート修正を含んでいます。 このイメージは、同僚にベースとして提供することを意図しています。各自の .war アプリケーションや standalone.xml をその上にデプロイできます。 CVE-2025-12543 の概要 項目| 詳細 ---|--- CVE...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: dependency-track, infinispan, apache-nifi, trino, logstash, opensearch, scala, akhq, apache-tika, druid, cass-config-builder, strimzi-kafka-operator, wildfly, apicurio-registry, spdx-tools-java, spark, keycloak, flyway, tez, apache-nifi-registry, gradle,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: dependency-track, infinispan, apache-nifi, trino, logstash, opensearch, scala, akhq, apache-tika, druid, cass-config-builder, strimzi-kafka-operator, wildfly, apicurio-registry, spdx-tools-java, spark, keycloak, flyway, tez, apache-nifi-registry, gradle,...

wildfly__wildfly_CVE-2018-1047_11-0-0-Final

WildFly アプリケーションサーバー http://wildfly.org 高速起動 小フットプリント モジュラーデザイン 統一設定と管理 そしてもちろん Java EE7! ビルド 前提条件: JDK 8 またはそれ以降 - java -version で確認 Maven 3.3.1 またはそれ以降 - mvn -v で確認 nix システムでは、ビルドを実行するユーザーの最大オープンファイル数が少なくとも 4096 であることを確認してください ulimit -n で確認 またはそれ以上。ユーザーが実行している他の I/O 負荷の高いプロセスによって異なります。 自身の Mave...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, dependency-track, cassandra, infinispan, zookeeper, zipkin, kserve-modelmesh, solr, logstash, trino, opensearch, nextflow, scala, akhq, apache-tika, celeborn, cassandra-reaper, druid, strimzi-kafka-operator, wildfly, jenkins-plugin-manager,...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, dependency-track, cassandra, infinispan, zookeeper, zipkin, kserve-modelmesh, solr, logstash, trino, opensearch, nextflow, scala, akhq, apache-tika, celeborn, cassandra-reaper, druid, strimzi-kafka-operator, wildfly, jenkins-plugin-manager,...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, dependency-track, cassandra, infinispan, zookeeper, zipkin, kserve-modelmesh, solr, logstash, trino, opensearch, nextflow, scala, akhq, apache-tika, celeborn, cassandra-reaper, druid, strimzi-kafka-operator, wildfly, jenkins-plugin-manager,...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, dependency-track, cassandra, infinispan, zookeeper, zipkin, kserve-modelmesh, solr, logstash, trino, opensearch, nextflow, scala, akhq, apache-tika, celeborn, cassandra-reaper, druid, strimzi-kafka-operator, wildfly, jenkins-plugin-manager,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, dependency-track, cassandra, infinispan, zookeeper, zipkin, kserve-modelmesh, solr, logstash, trino, opensearch, nextflow, scala, akhq, apache-tika, celeborn, cassandra-reaper, druid, strimzi-kafka-operator, wildfly, jenkins-plugin-manager,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, dependency-track, cassandra, infinispan, zookeeper, zipkin, kserve-modelmesh, solr, logstash, trino, opensearch, nextflow, scala, akhq, apache-tika, celeborn, cassandra-reaper, druid, strimzi-kafka-operator, wildfly, jenkins-plugin-manager,...

CLEANSTART-2026-KS26010 flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Acces...

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...