com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...

OESA-2026-4137 jss security update

Java Security Services JSS is a java native interface which provides a bridge for java-based applications to use native Network Security Services NSS. This only works with gcj. Other JREs require that JCE providers be signed. Security Fixes: A flaw was found in JSS Java Security Services. The...

CVE-2026-55511

CVE-2026-55511: Yamcs StreamSQL 認証済みRCE CVE-2026-55511 に対する非武器化された概念実証および技術文書です。これは、Yamcs StreamSQL 集約式コンパイラにおける認証済み Java コードインジェクションの脆弱性です。 フィールド| 値 ---|--- 製品| Yamcs org.yamcs:yamcs-core アドバイザリ| GHSA-3g44-3m7x-cgg2 脆弱性の種類| CWE-94: Improper Control of Generation of Code 深刻度| Critical, CVSS 3.1:...

CVE-2026-94052

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...

CVE-2026-102509 Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

CVE-2026-102509 Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

CVE-2026-102509

The Apache PLC4X (PLC4J) Java implementation is vulnerable to pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser . The root causes include memory allocation with excessive size values, allocation of resources without limits, and uncontrolled recursion. Specificall...

EUVD-2026-89678

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

cve-2017-12149-playground

多くの重要産業（銀行、医療、製造業）は、JBoss 5 または 6 専用に構築されたレガシーミドルウェアに依存しています。これらのアプリケーションは、多くの場合、WildFly（JBossの後継）の最新バージョンへの移行には脆弱すぎるため、組織はパッチを適用する代わりに「エアギャップ」を設けたり、VPNの背後に隠したりすることを選択します。そのような境界防御が失敗すると、脆弱性はそのまま生存し、パッチ未適用のまま残ります。 JBoss AS 6.1.0 脆弱性研究ラボ このリポジトリは、セキュリティ研究と脆弱性検証のために特別に構成された、コンテナ化されたJBoss Applicatio...

ddc

ddc — DEX → Java 反编译器（Rust） English | 简体中文 ddc 把 Android DEX 字节码反编译回可读的 Java —— 真实 App 级别的速度、 可以像数据库一样查询，并且经过 javac 验证 ：七个真实 APK 共 909,689 个输出文件全部零语法错误。 特性 快 —— 226MB/20 dex 的 weibo（9.8 万个类）全量反编译 5.0s ， 398MB 的飞书 5.5s ；病态类跑在带截止期的受控线程上，不会拖死 整个运行。 能编译 —— 七个基准...

CVE-2024-23897

CVE-2024-23897 環境構築 1. Java インストール sudo apt update sudo apt install openjdk-11-jdk -y 2. Jenkins WARファイルのダウンロード wget https://get.jenkins.io/war/2.441/jenkins.war 3. デフォルトJavaバージョンの変更 - Java 11を選択 sudo update-alternatives --config java 4. バージョン確認 - openjdk version "11.x.x" 確認 java -version 5...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE CVE-2023-43208 のProof-of-Conceptエクスプロイトです。これは、Mirth Connect のバージョン 4.4.1 未満における、認証不要のリモートコード実行（RCE）脆弱性です。 説明 Mirth Connectは広く使われているオープンソースのヘルスケア統合エンジンです。この脆弱性は、Apache Commons Collectionsのガジェットをチェーン化した細工されたXMLペイロードを使用して、/api/users...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: trino, thingsboard, sonarqube, scala, spdx-tools-java, strimzi-kafka-oauth, apache-tika, ruby3.3-jrjackson, wavefront-proxy, solr, flyway, cassandra, opensearch, neo4j, apicurio-registry, infinispan, kafka, tez, dependency-track, ruby4.0-jrjackson, ruby3.2-jrjackson,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: trino, thingsboard, sonarqube, scala, spdx-tools-java, strimzi-kafka-oauth, apache-tika, ruby3.3-jrjackson, wavefront-proxy, solr, flyway, cassandra, opensearch, neo4j, apicurio-registry, infinispan, kafka, tez, dependency-track, ruby4.0-jrjackson, ruby3.2-jrjackson,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: trino, thingsboard, sonarqube, scala, spdx-tools-java, strimzi-kafka-oauth, apache-tika, ruby3.3-jrjackson, wavefront-proxy, solr, flyway, cassandra, opensearch, neo4j, apicurio-registry, infinispan, kafka, tez, dependency-track, ruby4.0-jrjackson, ruby3.2-jrjackson,...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: trino, thingsboard, sonarqube, scala, spdx-tools-java, strimzi-kafka-oauth, apache-tika, ruby3.3-jrjackson, wavefront-proxy, solr, flyway, cassandra, opensearch, neo4j, apicurio-registry, infinispan, kafka, tez, dependency-track, ruby4.0-jrjackson, ruby3.2-jrjackson,...

SAP NetWeaver Application Server Java 7.5 - Local File Inclusion

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...

CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload Visual Composer の完全に認証不要のファイルアップロードエンドポイントにより、誰でも任意のファイル（例: JSP ウェブシェル）をサーバーにアップロードできます。 SAP NetWeaver Visual Composer の「Metadata Uploader」コンポーネントにおける、認証不要のファイルアップロード脆弱性（CVE-2025-31324）を検査・悪用するための Proof-of-Concept ツールです。 免責事項:...

com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...