snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC Compilar Puede compilar el jar en su máquina con mvn clean compile assembly:single O use docker para crear una imagen con docker build -t snakeyaml . Ejecutar Ejecute el contenedor con docker run --rm -p8080:8080 snakeyaml o el jar si lo compiló en su...

yaml-payload

yaml-payload Un payload de explotación de deserialización SnakeYAML para CVE-2022-1471 , adaptado de artsploit/yaml-payload originalmente basado en mbechler/marshalsec. Qué hace Cuando se carga a través del inseguro Yaml.load de SnakeYAML, este payload toma el control de la aplicación en ejecució...

cve-2022-1471-jira-lab

CVE-2022-1471 — Laboratorio de RCE de SnakeYAML contexto de Jira / Automation for Jira Laboratorio offline y autocontenido que demuestra el mecanismo detrás de CVE-2022-1471 deserialización insegura de SnakeYAML → RCE, CVSS 9.8, tal como se utiliza en el hallazgo de Jira / Jira Service Management...

Rocky Linux 8.6 [CIQ] Security Update: prometheus-jmx-exporter / prometheus-jmx-exporter-openjdk11 / etc (ciqsa-2026_0151)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260151 advisory. This advisory aggregates security fixes for the prometheus-jmx-exporter SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-1471. Tenable has extracted the precedin...

CVE-2022-1471-attacker

此存储库没有 README。...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC 用于 Veracode 博客的代码 为了演示代码执行： 1. 使用 Maven 构建项目 2. 执行 python3 -m http.server 8080 以运行 HTTP 服务器 3. 运行 exploit.java。你应该会在服务器上观察到一次 HTTP GET 请求 4. 为了演示 SnakeYAML 2.0 如何防止该攻击，请注释掉 pom.xml 中的 1.33 依赖 5. 取消注释 2.0 依赖，然后重新构建项目 6. 注释掉 exploit.java 并取消注释 Poc.java 7. 运行 Poc.java 并观察...

ROOT-APP-MAVEN-CVE-2022-1471 CVE-2022-1471 in org.yaml:snakeyaml - Patched by Root

Root has patched CVE-2022-1471 in the org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available...

seans-surf-and-skate

Sean's Surf & Skate Co. — सील सिक्योरिटी डेमो Maven / Java स्प्रिंग बूट के साथ बनाया गया एक छोटा लेकिन वास्तविक दिखने वाला ई-कॉमर्स स्टोरफ्रंट "Sean's Surf & Skate Co."। यह ज्ञात कमज़ोरियों वाली ओपन-सोर्स डिपेंडेंसियों के साथ आता है ताकि इसका उपयोग यह प्रदर्शित करने के लिए किया जा सके कि Seal...

seans-surf-and-skate

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A small but real-looking e-commerce storefront "Sean's Surf & Skate Co." built with Spring Boot. It ships with known-vulnerable open-source dependencies so it can be used to demonstrate how Seal Security remediates CVEs with backported...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

CVE-2022-1471 — SnakeYAML RCE lab Jira / Automation for Jira...

CLEANSTART-2026-MM56295 Security fixes in spark-sc212-jdk17-py311 3.4.4-r0

Package spark-sc212-jdk17-py311 version 3.4.4-r0 fixes 45 vulnerabilities: ghsa-mjmj-j48q-9wg2, CVE-2022-1471, ghsa-r7pg-v2c8-mfg3, CVE-2024-47561, CVE-2023-39410...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload A SnakeYAML deserialization exploit payload for...

RCE (Remote Code Execution) org.yaml:snakeyaml Dependency in Confluence Data Center

This Confluence release includes updates to our org.yaml:snakeyaml dependency in response to CVE-2022-1471. Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload Exploit payload JAR for demonstrating CVE-2022-...

HPESBNW04940 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities; Remote: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 5.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-47621 |...

Security Bulletin: IBM UrbanCode Build 6.1.7.10 addresses multiple vulnerabilities.

Summary Security Bulletin: IBM UrbanCode Build 6.1.7.10 addresses multiple vulnerabilities, listed in multiple CVEs CVE-2023-34981, CVE-2022-1471, CVE-2022-4065, CVE-2021-23450, CVE-2021-23450, CVE-2022-40151, CVE-2022-41966, CVE-2023-41080, CVE-2022-48285, CBE-2020-11971, CVE-2023-28709,...

Security Bulletin: IBM Sterling Global High Availability Mailbox is affected by a SnakeYaml deserialization vulnerability (CVE-2022-1471)

Summary IBM Sterling Global High Availability Mailbox is affected by SnakeYaml's Constructor class it does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's...

RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3198 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

RHEL 8 : OpenShift Container Platform 4.10.52 (RHSA-2023:0697)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0697 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...