SAP NetWeaver ICM - Detect

Detection of SAP NetWeaver ABAP Webserver or Java Application Server ICM/ICF !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP NetWeaver ABAP Webserver or Java Application Server ICM/ICF.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache Struts2 S2-008 RCE Detection

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. !/usr/bin/env python3 -- coding: utf-8...

ForgeRock OpenAM <7.0 - Remote Code Execution Detection

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

SCIMono <0.0.19 - Remote Code Execution Detection

SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system. !/usr/bin/env python3 -- coding: utf-8 -- """SCIMono before 0.""" from kittysploit import from...

Java Spring Detection

Detects Java Spring Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Java Spring Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Java Spring Detection', 'description': 'Detects Java Spring...

Unauthenticated Java Message Broker - Detect

Detection of a Java Message Service JMS broker, typically used by Oracle GlassFish Message Queue and Payara Application Server. This port should remain closed to the internet, as it enables unauthenticated access to messaging services. !/usr/bin/env python3 -- coding: utf-8 -- """Detection of a...

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition Detection

SAP NetWeaver AS JAVA LM Configuration Wizard, versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an...

Jolokia Java Heap Information Disclosure Detection

Detects Jolokia Java Heap Information Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jolokia Java Heap Information Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jolokia Java Heap...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization Detection

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

Apache JSPWiki - Detect

Detects a Apache JSPWiki web application, leading open source WikiWiki engine, feature-rich and built around standard JEE components Java, servlets, JSP. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache JSPWiki web application, leading open source WikiWiki engine, feature-rich and...

SAP NetWeaver Application Server Java 7.5 - Local File Inclusion Detection

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...

Jolokia Agent - JNDI Code Injection Detection

Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote...

Java-springboot-codebase 1.1 - Arbitrary File Read Detection

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

Fanruan Report 2012 Information Disclosure Detection

Fanruan Report 2012 has an information disclosure vulnerability, and some sensitive information can be obtained by accessing a specific URL !/usr/bin/env python3 -- coding: utf-8 -- """Fanruan Report 2012 has an information disclosure vulnerability, and some sensitive information can be obtaine."...

Tiny Java Web Server - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting...

DWR detect test page detection

The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way to find out what methods are exposed and learn how they function. !/usr/bin/env python3 -- coding:...

CVE-2026-45112

A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...

CVE-2026-59888

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: Update to upstream tag jdk-21.0.12+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3332-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: Update to upstream tag jdk-21.0.12+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...