59765 matches found
io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...
bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...
Osinton
Osinton Osinton es una herramienta OSINT Inteligencia de Fuentes Abiertas de código abierto diseñada para realizar investigaciones estructuradas sobre personas utilizando información disponible públicamente. El proyecto permite a los usuarios buscar, correlacionar y analizar huellas digitales com...
JarHunter
JarHunter – 高级JAR分析与提取工具 JarHunter 是一款旨在快速高效地探索、搜索和从大型 JAR 文件中提取特定类的工具。 无需手动浏览数千个类，JarHunter 允许您在整个 JAR 文件中搜索关键字，并仅提取相关的类。 功能特性 JAR 结构浏览器 跨 JAR 关键字搜索 优化的字节码搜索 多选提取 重构的 Java 源代码导出 自动报告生成 深色主题界面 JarHunter 可通过以下链接获取： https://gumroad.com/products/ifkdbr/edit...
Retrofit-1
Retrofit Cliente HTTP seguro en tipos para Android y Java por Square, Inc. Para más información, visite el sitio web. Descarga Descargue el último JAR u obténgalo mediante Maven: root@kitploit: com.squareup.retrofit2 retrofit 2.4.0 o Gradle: root@kitploit: implementation...
apache__mina-sshd_CVE-2023-35887_2-9-2
Apache MINA SSHD Apache MINA SSHD es una biblioteca 100% Java pura para dar soporte a los protocolos SSH tanto en el lado del cliente como en el del servidor. No pretende ser un reemplazo del cliente SSH o del servidor SSH de los sistemas operativos Unix, sino proporcionar soporte para aplicacion...
CVE-2023-46604
CVE-2023-46604 por Ruben Fobe & Klaas Stessens Introducción ADVERTENCIA Este proyecto está destinado únicamente a fines educativos y de laboratorio. Solo utiliza estas técnicas en entornos que te pertenezcan o para los que estés autorizado a realizar pruebas. Este laboratorio simulará la...
CVE-2022-21445
Exploit CVE-2022-21445 - PoC Este kit de herramientas genera payloads de exploit para CVE-2022-21445, una vulnerabilidad crítica de deserialización de Java que afecta a Oracle WebLogic Server 12.2.1.x que ejecuta Oracle ADF Faces. La falla existe en el componente RemoteApplicationResourceLoader y...
ROOT-APP-MAVEN-CVE-2026-40983 CVE-2026-40983 in io.micrometer:micrometer-core - Patched by Root
Root has patched CVE-2026-40983 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available...
apache__sling-org-apache-sling-servlets-resolver_CVE-2024-23673_2-10-0
...
Security Bulletin: Vulnerabilities in IBM SDK, Java Technology (CVE-2026-16440, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589) affect Power PowerVM Novalink
Summary The IBM SDK, Java Technology used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...
f-for-java
f-for-java un proyecto escrito en go y java que abandoné por CVE-2021-44228 intenta arreglarlo si puedes XD EL MÓDULO EN JAVA NO ES MÍO...
CVE-2024-36401-WoodpeckerPlugin
CVE-2024-36401-WoodpeckerPlugin 简介 CVE-2024-36401 批量探测和利用，支持自定义内存马注入 1. 可批量探测 2. 对 url 地址后端已进行过滤（只管丢 url 就行） 3. 可以自定义生成内存马进行注入（默认的内存马注入已添加注入器类名: java.lang.test 「目的是为了JDK11下的defineAnonymousClass绕过」） 安装 下载源码执行 root@kitploit: mvn package 将 target 下的jar包放在 woodpecker-framework 下的 plugin 文件夹中...
CVE-2026-40858
Reproducción de la deserialización insegura del repositorio de agregación remota camel-infinispan CVE-2026-40858 Este proyecto demuestra una vulnerabilidad de deserialización de Java en el componente camel-infinispan de Apache Camel, registrada como CVE-2026-40858. El repositorio de agregación...