JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization

The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server AS 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denia...

jexboss

JexBoss - JBoss and others Java Deserialization Vulnerabilities verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc. Requirements Python = 2.7.x urllib3 ipaddress Installatio...

openrasp

OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc. When an attack happens, WAF...

clusterd

clusterd clusterd is an open source application server attack toolkit. Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. See the wiki for more information...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities due to RESTEasy and Apache CXF

Summary There are mulitple vulnerabilities in the RESTEasy and Apache CXF library that affect IBM WebSphere Application Server Liberty with the restfulWS-3.0, restfulWS-3.1, restfulWS-4.0, jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0 or xmlWS-4.0 enabled. Vulnerability Details CVEID:CVE-2026-108039...

SAP NetWeaver Application Server Java 7.5 - Local File Inclusion

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...

wildfly__wildfly_CVE-2018-1047_11-0-0-Final

WildFly Application Server http://wildfly.org Fast Startup Small Footprint Modular Design Unified Configuration and Management And of course Java EE7! Building Prerequisites: JDK 8 or newer - check java -version Maven 3.3.1 or newer - check mvn -v On nix systems, make sure that the maximum number...

Vulnerabilities fixed in SAP products

SAP has addressed multiple vulnerabilities across various SAP products, including SAP NetWeaver Application Server ABAP, SAP NetWeaver AS Java, SAP Web Dispatcher, SAP BusinessObjects Business Intelligence Platform, SAP Cloud SDK, SAP Host Agent, SAP NetWeaver Enterprise Portal, SAP NetWeaver...

SAP NetWeaver Memory Corruption (3778530)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3778530: - SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An...

IBM WebSphere Application Server 8.5.x < 8.5.5.32 / 9.x < 9.0.5.30 (7295372)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7295372 advisory. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an...

IBM WebSphere Application Server 9.x < 9.0.5.30 (7292227)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7292227 advisory. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.j...

SAP NetWeaver Denial of Service (3805681)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a denial of service vulnerability as referenced in SAP Security Note 3805681: - SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when...

SAP NetWeaver Multiple Vulnerabilities (3769130)

The version of the SAP NetWeaver kernel detected on the remote host is affected by multiple vulnerabilities as referenced in SAP Security Note 3769130: - Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an...

SAP NetWeaver OS Command Injection (3792735)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an OS command injection vulnerability as referenced in SAP Security Note 3792735: - SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal...

CVE-2025-31324

CVE-2025-31324 How does this detection method work? The template performs an HTTP GET request to the target's base URL and examines the response headers to identify SAP NetWeaver Application Server instances. This information helps assess whether the system might be susceptible to CVE-2025-31324...

Security Bulletin: IBM WebSphere Application Server Liberty, bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

CVE-2026-89119

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on...

CVE-2026-76964

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation...

CVE-2026-76973

Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt acti...

CVE-2026-76966

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high...