CVE-2017-1000486

CVE-2017-1000486 Эксплойт удаленного выполнения кода для PrimeFaces 5.x - EL Injection CVE-2017-1000486 Это по сути тот же эксплойт, созданный Mogwailabs, но измененный для работы в закрытых средах без доступа к интернету или с заблокированным исходящим трафиком брандмауэра. Он выдает результаты ...

CVE-2020-10199

Nexus Repository Manager 3 Vuln Поддерживаемые версии: = 3.21.2 CVE-2020-10199, CVE-2020-10204, CVE-2020-11444 CVE-2020-10199 Удаленное выполнение кода PoC с обратной связью PoC без обратной связи $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199'...

hopgoblin

hopgoblin hopgoblin은 Adobe Experience ManagerAEM 인스턴스를 위한 스캐너입니다. 보안 평가 중에 수동으로 수행하던 여러 검사를 자동화합니다. 기능 노출된 QueryBuilder 엔드포인트 탐지: /bin/querybuilder.json /bin/querybuilder.feed QueryBuilder를 악용하여: rep:User 객체와 유출된 비밀번호 해시 열거 쓰기 가능한 JCR 노드 식별 /services/accesstoken/verify를 통한 SSRF Jackrabbit 패키지...

CVE-2018-12533

RF-14310 / CVE-2018-12533 페이로드 생성기 Lucifaer 연구 기반 모든 크레딧은 https://github.com/Lucifaer 로 참고 자료 https://access.redhat.com/security/cve/cve-2018-12533 richfaces-jboss-poc 오래된 Java 버전 등에 대해 너무 걱정하지 않고 Richfaces 3.3.4 역직렬화 + EL 주입 공격을 연습할 수 있는 손쉽게 배포 가능한 개념 증명입니다. jboss Docker 배포 취약한 애플리케이션을 설정하는 번거로움...

pwnfaces

😛 pwnfaces Primefaces 5.X EL 注入漏洞利用工具 🕵️ 什么是 pwnfaces？ 🕵️ pwnfaces 是一款用 Golang 编写的工具，用于利用被定义为 CVE-2017-1000486（PrimeFaces 5.X 中的 EL 注入）的漏洞。 ⚡ 安装 / 开始使用 关于如何安装和使用 pwnfaces 的快速指南。 root@kitploit: 1. go install github.com/oppsec/pwnfaces@latest 2. pwnfaces -u...

Sonatype Nexus Repository Manager 3 - Remote Code Execution

Sonatype Nexus Repository Manager 3 up to and including 3.21.1 is vulnerable to Expression Language injection. An attacker authenticated with an administrative account can inject an EL expression into the user "roles" field of the coreuiUser update endpoint, leading to remote code execution. This...

CVE-2017-1000486

CVE-2017-1000486 이것은 CVE-2017-1000486의 PoC로, RCE를 달성하는 데 사용되는 표준 함수getClass, exec 등에 대한 블랙리스트 사전식 검사를 우회하고, Padding Oracle을 통해 primefaces 시크릿을 검색하여 익스플로잇 시 노이즈를 최대한 줄이는 데 유용한 몇 가지 페이로드를 포함합니다. 이 주제와 관련된 작업을 해주신 @pimps , @federicodotta , @AonCyberLabs 님께 감사드립니다. 설명 이 PoC는 모든 애플리케이션과 사용 가능한 웹 서버...

Nexus-Repository-Manager3-EL-CVE-2018-16621-https-www.cve.org-CVERecord-id-CVE-2018-16621-

Этот скрипт нацелен на уязвимость EL-инъекции в Nexus Repository Manager 3 CVE-2018-16621 для однокликового выполнения эксплойта с получением обратной оболочки reverse shell Пример запуска: Запустите скрипт на атакующей машине, следуя подсказкам, введите IP и порт цели, а также IP и порт...

cve-2018-14667

cve-2018-14667 CVE-2018-14667에 대한 POC 원본 분석 및 POC: https://paper.seebug.org/765/ 참조: https://web.archive.org/web/20190501081357/https://tint0.com/when-el-injection-meets-java-deserialization/...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 또는 6.0 - 원격 코드 실행 익스플로잇 요구 사항을 설치하려면 다음을 실행하세요: root@kitploit: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt 익스플로잇 사용 방법은 다음과 같습니다: root@kitploit: $ python primefaces.py -h...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

CVE-2017-1000486

CVE-2017-1000486 Эксплойт Proof of Concept для PrimeFaces 5.x EL Injection CVE-2017-1000486, уязвимость RCE, которая может быть использована для удаленного выполнения кода на цели. Описание уязвимости Вы можете найти отличное описание уязвимости в блоге Minded Security. Использование Эксплойт...

CVE-2026-2587-Exploit-POC

CVE-2026-2587 Эксплойт PoC — Валидатор EL-инъекции RCE в Eclipse GlassFish Безопасный валидатор PoC для CVE-2026-2587, критической проблемы EL-инъекции / RCE, затрагивающей обработку гаджетов консоли администрирования Eclipse GlassFish через /common/gadgets/gadget.jsf. Этот инструмент помогает...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: hibernate-validator (UTSA-2026-093179)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093179 advisory. A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

CVE-2026-64555

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSREL2 restore in kvmhyphandlemops kvmhyphandlemops resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpucpsr and writing the result directly into hardware. In...

EUVD-2026-49606

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSREL2 restore in kvmhyphandlemops kvmhyphandlemops resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpucpsr and writing the result directly into hardware. In...

UBUNTU-CVE-2026-64287

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...