x-stream__xstream_CVE-2021-21345_1-4-15

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

CVE-2020-9496

CVE-2020-9496 - RCE Debido a que las 2 solicitudes relacionadas con xmlrpc en webtools xmlrpc y ping no utilizan autenticación, son vulnerables a deserialización insegura. Este problema fue reportado al equipo de seguridad por Alvaro Munoz [email protected] del equipo GitHub Security Lab. Es...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

zkar

ZKar ZKar es una herramienta de análisis del protocolo de serialización de Java implementada en Go. Esta herramienta aún está en desarrollo , por lo que no hay una guía de API completa ni de contribución. ZKar proporciona: Un analizador y visor de cargas útiles de serialización de Java en Go puro...

cve-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

XStream-1

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...

javaserializetools

This repository does not have a README...

CVE-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput Unsafe Deserialization Reproducer CVE-2026-40473 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-mina component, tracked as CVE-2026-40473. The MinaConverter.toObjectInputIoBuffer type converter wraps the received bytes...

x-stream__xstream_CVE-2013-7285_1-4-6

XStream root@kitploit: "Java to XML Serialization, and back again" -- Binaries ----------------------------------------------- All binary artifacts are in the 'lib' directory. These include the xstream jars and any other library used at build time, or optional runtime extras. kXML2 is recommend...

Astra Linux – Vulnerability in libxstream-java

XStream is an open-source Java library for serializing objects to XML and back. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% of the CPU time on the target system, depending on the CPU type or through parallel execution of such operations. This can lead to a denial of...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

GHSA-XWW8-MXQW-M84W Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-43865 Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

PT-2026-55883

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in...

PT-2026-55884

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description The camel-hazelcast component manages Hazelcast instances using a default configuration that lacks a...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Control of Generation of Code ('Code Injection') (CVE-2026-27830)

Summary There are vulnerabilities in c3p0-0.9.5.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-27830. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is vulnerable to attack via...