1711 matches found
struts2-rce-cve-2017-9805-ruby
Struts2 Vulnerability - CVE-2017-9805 Description Apache Struts2 REST Plugin XStream RCECVE-2017-9805 Usage Usage: cve20179805poc.rb targeturi cmd ruby cve20179805poc.rb 127.0.0.1 ping -c 4 192.168.0.1...
CVE-2017-9805
CVE-2017-9805 CVE-2017-9805 POC The issue comes from a lack of filtering on the deserialization class used by the REST plugin. Struts uses Xstream with a lot of filtering for deserialization in multiple places, however this filtering was not in place for the REST plugin...
CVE-2020-26217-XStream-RCE-POC
CVE-2020-26217-XStream-RCE-POC e.g package org.example; import com.thoughtworks.xstream.XStream; import java.io.IOException; public class CVE202026217 public static void mainString args throws IOException XStream xStream = new XStream; String payload = "\n" + " \n" + " \n" + " 0\n" + " \n" + " \n...
x-stream__xstream_CVE-2020-26217_1-4-14-java77
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...
CVE-2020-26259
CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml com.thoughtworks.xstream xstream 1.4.14 poc...
XStream <1.4.18 - Server-Side Request Forgery
XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify...
XStream 1.4.18 - Arbitrary Code Execution
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...
XStream <1.4.15 - Server-Side Request Forgery
XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...
XStream 1.4.18 - Remote Code Execution
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...
XStream <1.4.16 - Remote Code Execution
XStream before 1.4.16 is susceptible to remote code execution. An attacker can load and execute arbitrary code from a remote host via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative...
CVE-2021-21349
CVE-2021-21349 XStream SSRF XStream Official Announcement CVE-2021-21349 Vulnerability CVE-2021-21349: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. Affected Versions...
-CVE-2017-9805-
Información de vulnerabilidad Recursos: https://vulners.com/cve/CVE-2017-9805 ¿Qué es esto? Un script de exploit en Python capaz de ejecutar comandos remotos en el shell de un sistema que aloja un Struts2 vulnerable a S2-052. Uso python s2-052.py --target 'http://192.168.0.233/orders/3' --command...
Xstream-1.4.17
Xstream-1.4.17 The above Xstream Demo environment was built by me. The vulnerability exploitation environment is based on JDK1.8u131. It currently supports local testing and HTTP remote packet sending. XSTREAM=1.4.17 vulnerability reproduction CVE-2021-39141, CVE-2021-39144, CVE-2021-39150,...
x-stream__xstream_CVE-2021-21345_1-4-15
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...
CVE-2023-43208
CVE-2023-43208 — Mirth Connect Pre-Auth RCE Pre-authenticated Remote Code Execution in NextGen Healthcare Mirth Connect CVSS 9.8 Critical — Patch bypass of CVE-2023-37679 Overview Mirth Connect uses the Java XStream library to deserialize XML payloads on the /api/users endpoint without...
Xstream_cve-2022-41966
Xstreamcve-2022-41966 cve-2022-41966 debug code...
xstream-CVE-2020-26217
xstream-CVE-2020-26217...
xstream-CVE-2020-26258
xstream-CVE-2020-26258...