zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

zkar

ZKar ZKar est un outil d'analyse du protocole de sérialisation Java implémenté en Go. Cet outil est encore en cours de développement , il n'y a donc pas de documentation API complète ni de guide de contribution. ZKar fournit : Un analyseur et visualiseur de charges utiles de sérialisation Java en...

CVE-2020-9496

CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in webtools xmlrpc and ping are not using authentication they are vulnerable to unsafe deserialization. This issue was reported to the security team by Alvaro Munoz [email protected] from the GitHub Security Lab team. This vulnerabilit...

javaserializetools

Ce depot n’a pas de fichier README...

x-stream__xstream_CVE-2021-21345_1-4-15

master: v-1.4.x: XStream Sérialisation Java vers XML, et inversement Binaires Tous les artefacts binaires sont regroupés dans l’archive -bin. Elle inclut les jars XStream et toute autre bibliothèque utilisée au moment de la compilation, ou des extras facultatifs à l’exécution. Xpp3 est recommandé...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Сериализация Java в XML и обратно Бинарные файлы Все бинарные артефакты включены в архив -bin. Он содержит JAR-файлы XStream и все остальные библиотеки, используемые во время сборки, или дополнительные компоненты времени выполнения. Для использования рекомендуется MXParse...

cve-2023-34040

CVE-2023-34040 Désérialisation Spring Kafka et exécution de code à distance POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

CVE-2023-34040

CVE-2023-34040 Exécution de code à distance par désérialisation dans Spring Kafka POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput Reproducer de désérialisation non sécurisée CVE-2026-40473 Ce projet démontre une vulnérabilité de désérialisation Java dans le composant camel-mina d'Apache Camel, suivie sous le numéro CVE-2026-40473. Le convertisseur de type...

XStream-1

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...

x-stream__xstream_CVE-2013-7285_1-4-6

XStream "Сериализация Java в XML и обратно" -- Бинарные файлы ----------------------------------------------- Все бинарные артефакты находятся в каталоге 'lib'. Они включают jar-файлы xstream и любые другие библиотеки, используемые во время сборки, или дополнительные компоненты времени выполнения...

Astra Linux – Vulnerability in libxstream-java

XStream is an open-source Java library for serializing objects to XML and back. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% of the CPU time on the target system, depending on the CPU type or through parallel execution of such operations. This can lead to a denial of...

Deserialization of untrusted data vulnerability in performance

performance uses Java serialization to cache performance reports in the build directory. performance 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller. This...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

The vulnerability of the userOverridesAsString method in the JDBC driver library allows a hacker to execute arbitrary code.

The vulnerability of the userOverridesAsString method in the JDBC driver handling library in c3p0 is related to incorrect code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created Java serializable objects and instances of...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

GHSA-XWW8-MXQW-M84W Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...