dubbo-CVE-2023-23638

CVE-2023-23638 仅供学习研究 ZooKeeper 自备 测试环境为 Java 8, 其它版本尚未测试, 不保证可用性 复现时需要为 DemoComsumer 添加 VM 参数: -Ddubbo.hessian.allowNonSerializable=true, 详情参考 https://su18.org/post/hessian/serializable 分析文章: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ POC 的本质是利用某个 class 修改...

dubbo-rce

CVE-2023-23638 仅供学习研究 ZooKeeper 自备 测试环境为 Java 8, 其它版本尚未测试, 不保证可用性 复现时需要为 DemoComsumer 添加 VM 参数: -Ddubbo.hessian.allowNonSerializable=true, 详情参考 https://su18.org/post/hessian/serializable 分析文章: https://exp10it.io/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ POC 的本质是利用某个 class 修改...

CVE-2021-43297-POC

CVE-2021-43297 Descripción de la vulnerabilidad Existe un riesgo potencial de ataque RCE en Dubbo Hessian-Lite 3.2.11 y versiones anteriores. Cuando Hessian-Lite encuentra una excepción de serialización, genera información relacionada, lo que puede provocar la invocación del método toString de...

Dubbo-deserialization

介绍 JNDI注入利用工具，生成JNDI链接并启动后端相关服务，可用于Fastjson、Jackson等相关漏洞的验证。 使用 可执行程序为jar包，在命令行中运行以下命令： root@kitploit: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C command -A address 其中: -C - 远程class文件中要执行的命令。 （可选项 , 默认命令是mac下打开计算器，即"open /Applications/Calculator.app"） -A - 服务器地址，可以是IP地址或者域名。 （可选项...

CVE-2023-38035-MobileIron-RCE

MobileIron CVE-2023-38035 Exploit README.md Descripción Este script bash automatiza el proceso de escaneo de sistemas MobileIron vulnerables susceptibles al exploit CVE-2023-38035. El script realiza múltiples comprobaciones, incluyendo verificar los programas necesarios, descargar posibles...

CVE-2026-19826 alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

Apache HugeGraph-Server Deserialization Vulnerability

Apache HugeGraph-Server is a server-side process for graph databases from the Apache Foundation. Apache HugeGraph-Server suffers from a deserialization vulnerability that stems from insecure Hessian deserialization in the PD store, which can be exploited by an attacker to cause remote code...

CVE-2025-26866

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Remote Code Execution (RCE)

org.apache.dubbo:dubbo is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization handling in hessian-lite during exception logging, which allows an attacker to execute malicious code through crafted serialized data...

Remote Code Execution (RCE)

org.apache.hugegraph, hg-pd-core is vulnerable to a Remote Code Execution. The vulnerability is due to insecure Hessian deserialization in the Raft cluster membership logic, where a malicious Raft node can send crafted objects that bypass type safety and trigger unsafe deserialization and attacke...

GHSA-Q37J-3367-FWV7 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via insecure Hessian deserialization in the PD store. An attacker can execute arbitrary code by sending maliciously crafted data from a compromised or rogue Raft node. Details Serialization is a process...

EUVD-2025-203068

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866

CVE-2025-26866 affects Apache HugeGraph-Server (HugeGraph-Server PD store) via insecure Hessian deserialization and RAFT-related manipulation, enabling remote code execution. Multiple sources describe a server-side deserialization vulnerability stemming from Hessian deserialization, with the miti...

Apache HugeGraph-Server 安全漏洞

Apache HugeGraph-Server is a server-side process for graph databases from the Apache Foundation. Apache HugeGraph-Server suffers from a deserialization vulnerability that stems from insecure Hessian deserialization in the PD store, which can be exploited by an attacker to cause remote code...