ROOT-APP-MAVEN-CVE-2022-22970 CVE-2022-22970 in org.springframework:spring-beans - Patched by Root

Root has patched CVE-2022-22970 in the org.springframework:spring-beans package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-22965 CVE-2022-22965 in org.springframework:spring-beans - Patched by Root

Root has patched CVE-2022-22965 in the org.springframework:spring-beans package for Root:Maven. Multiple fixed versions available...

cve-2021-21985_exp

cve-2021-21985 エクスプロイト 0x01 脆弱性ポイント 分析から分かること： https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985?referrer=homerapid7-analysis 0x02 エクスプロイト beansオブジェクトを再構築し、RCEを実現する。 beanリスト： localizedMessageBundle vsanWorkerThreadFactory vsanThreadPoolImpl vsanServiceBundleActivator vsanServiceFactory...

fastjson-tp1fn1

json.org CVE-2022-45688 true & false positive WTF ?? 이 프로젝트에는 CVE-2022-25845 취약점이 있는 fastjson 의존성이 포함되어 있습니다. 취약점은 JSON 내의 마크업이 Java 빈bean으로 해석될 때 발생합니다. 즉, 클래스가 인스턴스화되고 setter 메서드를 실행하여 속성이 설정됩니다. 이는 리플렉션reflection을 사용하여 수행됩니다. setter가 코드 실행과 같은 동작을 유발할 수 있는 클래스가 클래스패스에 존재하는 경우예제에서는 이 클래스가...

EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, Spring Beans and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring...

CVE-2026-55223 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

CVE-2026-42588 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy...

MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.5-2.2.1.AXS4 (AXSA:2012-909:02)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-909:02 advisory. The OpenJDK runtime environment. Security issues fixed with this release: CVE-2012-0547 Unspecified vulnerability in the Java Runtime Environment JRE...

ysoserial

ysoserial !GitHub releasehttps://img.shields.io/github/do...

Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-beans-6.2.3.jar (CVE-2025-41242)

Summary IBM Sterling Connect:Direct Web Services is vulnerable toPath Traversal Vulnerability in spring-beans-6.2.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a...

EUVD-2013-5626

Malware in sbrugna...

EUVD-2009-2086

Malware in sbrugna...

EUVD-2013-0455

Malware in sbrugna...

EUVD-2012-4477

Malware in sbrugna...

EUVD-2025-11528

Malicious code in bioql PyPI...

EUVD-2022-5420

Malicious code in bioql PyPI...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...