fastjson-jsontype-rce-lab

Fastjson @JSONType 원격 JAR/FD 체인 연구소 및 탐지 이 저장소는 이제 두 개의 별도 Fastjson 연구 트랙을 제공합니다: modern-fd/는 권장되는 마커 전용 재구성으로, Spring Boot 3, 일반 임베디드 Tomcat 및 JDK 17에서 Fastjson 1.2.83 단일 본문 원격 JAR/파일 디스크립터 체인을 재현합니다. AutoType을 비활성화한 상태에서 리터럴 고정 DTO 싱크인 JSON.parseObjectbody, BoundEnvelope.class를 사용합니다. 원래 최상위...

CVE-2026-75430_PowerJob_worker_deployContainer_RCE

PowerJob Worker の /worker/deployContainer 経由の認証なしリモートコード実行（任意JARロード） 1. 概要 PowerJob Worker は、HTTPトランスポートポート27777上で deployContainer ハンドラをいかなる認証もなしに 公開しています。攻撃者は任意のURLを送信し、Worker はそのJARをダウンロードして URLClassLoader と Spring ClassPathXmlApplicationContext を介してロードし、Spring の init-method 中に任意のコードを実行します →...

CVE-2026-0848

CVE-2026-0848 — NLTK StanfordSegmenter: 信頼できないJARの読み込みによる任意コード実行 -red?style=for-the-badge -brightgreen?style=for-the-badge 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2026-0848 パッケージ| nltk Natural Language Toolkit レジストリ| PyPI 影響を受けるバージョン| = 3.9.2 脆弱性タイプ| CWE-20: 不適切な入力検証 CVSSスコア| 10.0 Critical 攻撃元区分| ネットワーク...

CVE-2026-90466

Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'. The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path...

EUVD-2026-94223

Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'. The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path...

PT-2026-107433

Path traversal of 'trusted jar paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted jar paths'. The startup flag 'trusted jar paths' references URIs for loading files from local or remote filesystems. Path...

cve-2021-29442-Nacos-Derby-rce-exp

소개 Nacos Derby 명령 실행 취약점 악용 스크립트로, 기본적으로 User-Agent 우회 취약점을 이용합니다. Nacos는 서비스 등록, 발견 및 구성 관리를 위한 오픈 소스 플랫폼입니다. 초기 버전≤2.4.0-BETA에서 Nacos는 기본적으로 Apache Derby를 임베디드 데이터베이스로 통합했습니다. Derby 데이터베이스는 기본적으로 액세스 제어가 설정되어 있지 않기 때문에 공격자는 승인 없이 특정 인터페이스에 접근하여 임의의 SQL 문을 실행할 수 있으며, 이는 결국 원격 명령 실행 취약점으로 이어집니다...

Fastjson 1.2.83 Remote Code Execution

Fastjson versions 1.2.68 through 1.2.83 contain a remote code execution vulnerability that can allow an attacker to cause a vulnerable application to load attacker-controlled Java classes. This proof of concept generates a malicious JAR containing a reverse shell payload, serves the JAR over HTTP...

DEBIAN-CVE-2026-12252

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute...

EUVD-2026-30512

SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream reading from the beginning of the file, but loads classes using class JarFile/URLClassLoader reading the Central Directory from the end. It can lead to remote code execution by allowing an attacker to combine ...

EUVD-2026-9875

NLTK versions =3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of...

CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading

NLTK versions =3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of...

CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading

NLTK versions =3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of...

CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading

NLTK versions =3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of...

The vulnerability of the Validate JSP File function in the IntelliJ IDEA integrated development environment allows attackers to load any JAR files they desire.

The vulnerability of the Validate JSP File function in the IntelliJ IDEA integrated development environment is related to the transmission of critical information in open text. Exploiting this vulnerability allows a malicious actor to download arbitrary JAR files remotely...

Deserialization of untrusted data

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...