dubbo-rce

CVE-2023-23638 仅供学习研究 ZooKeeper 自备 测试环境为 Java 8, 其它版本尚未测试, 不保证可用性 复现时需要为 DemoComsumer 添加 VM 参数: -Ddubbo.hessian.allowNonSerializable=true, 详情参考 https://su18.org/post/hessian/serializable 分析文章: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ POC 的本质是利用某个 class 修改...

dubbo-CVE-2023-23638

CVE-2023-23638 仅供学习研究 ZooKeeper 自备 测试环境为 Java 8, 其它版本尚未测试, 不保证可用性 复现时需要为 DemoComsumer 添加 VM 参数: -Ddubbo.hessian.allowNonSerializable=true, 详情参考 https://su18.org/post/hessian/serializable 分析文章: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ POC 的本质是利用某个 class 修改...

CVE-2014-085

CVE-2014-085 PoC y campo de pruebas para la vulnerabilidad de acceso no autorizado en ZooKeeper CVE-2014-085 uso ./nuclei -duc -t zookeeper-unauth.yaml -u ip...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.2.0 Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, ruby4.0-jrjackson, strimzi-kafka-oauth, wildfly, strimzi-kafka-operator, trino, celeborn, sonarqube, wavefront-proxy, thingsboard, ruby3.2-jrjackson, scala, spdx-tools-java, infinispan, druid, cassandra-reaper, confluent-kafka, apache-pulsar,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, ruby4.0-jrjackson, strimzi-kafka-oauth, wildfly, strimzi-kafka-operator, trino, celeborn, sonarqube, wavefront-proxy, thingsboard, ruby3.2-jrjackson, scala, spdx-tools-java, infinispan, druid, cassandra-reaper, confluent-kafka, apache-pulsar,...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, ruby4.0-jrjackson, strimzi-kafka-oauth, wildfly, strimzi-kafka-operator, trino, celeborn, sonarqube, wavefront-proxy, thingsboard, ruby3.2-jrjackson, scala, spdx-tools-java, infinispan, druid, cassandra-reaper, confluent-kafka, apache-pulsar,...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, ruby4.0-jrjackson, strimzi-kafka-oauth, wildfly, strimzi-kafka-operator, trino, celeborn, sonarqube, wavefront-proxy, thingsboard, ruby3.2-jrjackson, scala, spdx-tools-java, infinispan, druid, cassandra-reaper, confluent-kafka, apache-pulsar,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, ruby4.0-jrjackson, strimzi-kafka-oauth, wildfly, strimzi-kafka-operator, trino, celeborn, sonarqube, wavefront-proxy, thingsboard, ruby3.2-jrjackson, scala, spdx-tools-java, infinispan, druid, cassandra-reaper, confluent-kafka, apache-pulsar,...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, ruby4.0-jrjackson, strimzi-kafka-oauth, wildfly, strimzi-kafka-operator, trino, celeborn, sonarqube, wavefront-proxy, thingsboard, ruby3.2-jrjackson, scala, spdx-tools-java, infinispan, druid, cassandra-reaper, confluent-kafka, apache-pulsar,...

CVE-2026-59969

A flaw was found in Apache ZooKeeper. When operating in FIPS Federal Information Processing Standards mode with specific Transport Layer Security TLS settings enabled, ZooKeeper's quorum communication fails to properly verify the hostname of peer certificates. This vulnerability allows a maliciou...

CVE-2026-84501

A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log...

CVE-2026-59739

A flaw was found in Apache ZooKeeper. This vulnerability allows a remote attacker to discover paths that should be restricted by Access Control Lists ACLs. By registering watches on non-existent paths and then reconnecting after these paths are created with restricted ACLs, the attacker can bypas...

GHSA-PH9C-7HW9-VHHW vulnerabilities

Vulnerabilities for packages: opensearch, druid, akhq, kafka, apache-pulsar, zookeeper, spark...

CVE-2026-77421 vulnerabilities

Vulnerabilities for packages: opensearch, druid, akhq, kafka, apache-pulsar, zookeeper, spark...

GHSA-R2XF-8XR9-62GW vulnerabilities

Vulnerabilities for packages: druid, wazuh-indexer, apache-pulsar, ghidra, pinot-fips, apache-nifi, zookeeper, spark-fips, apache-camel-karavan-devmode, spark, akhq, pinot, opensearch-fips, zookeeper-fips, kafka-fips, kafka, hadoop-client-modules, apache-pulsar-fips, hadoop-fips, opensearch, scal...

GHSA-PH9C-7HW9-VHHW vulnerabilities

Vulnerabilities for packages: druid, wazuh-indexer, apache-pulsar, ghidra, pinot-fips, apache-nifi, zookeeper, spark-fips, apache-camel-karavan-devmode, spark, akhq, pinot, opensearch-fips, zookeeper-fips, kafka-fips, kafka, hadoop-client-modules, apache-pulsar-fips, hadoop-fips, opensearch, scal...

CVE-2026-77421 vulnerabilities

Vulnerabilities for packages: druid, wazuh-indexer, apache-pulsar, ghidra, pinot-fips, apache-nifi, zookeeper, spark-fips, apache-camel-karavan-devmode, spark, akhq, pinot, opensearch-fips, zookeeper-fips, kafka-fips, kafka, hadoop-client-modules, apache-pulsar-fips, hadoop-fips, opensearch, scal...

CVE-2026-77422 vulnerabilities

Vulnerabilities for packages: druid, wazuh-indexer, apache-pulsar, ghidra, pinot-fips, apache-nifi, zookeeper, spark-fips, apache-camel-karavan-devmode, spark, akhq, pinot, opensearch-fips, zookeeper-fips, kafka-fips, kafka, hadoop-client-modules, apache-pulsar-fips, hadoop-fips, opensearch, scal...

GHSA-5Q95-HRPC-M3W3 vulnerabilities

Vulnerabilities for packages: druid, wazuh-indexer, apache-pulsar, ghidra, elasticsearch, pinot-fips, apache-nifi, zookeeper, hadoop-client-modules, spark-fips, apache-camel-karavan-devmode, spark, akhq, pinot, opensearch-fips, zookeeper-fips, kafka-fips, kafka, elasticsearch-fips,...