Security update for java-11-openj9 (important)

openSUSE Security Update: Security update for java-11-openj9 Announcement ID: openSUSE-SU-2025:0351-1 Rating: important References: 1235844 1241274 1241275 1241276 1246575 1246580 1246584 1246595 1246598 1246806 Cross-References: CVE-2025-21587 CVE-2025-30691 CVE-2025-30698 CVE-2025-30749...

Security update for java-17-openj9 (important)

openSUSE Security Update: Security update for java-17-openj9 Announcement ID: openSUSE-SU-2025:0354-1 Rating: important References: 1235844 1241274 1241275 1241276 1246575 1246584 1246595 1246598 1246806 Cross-References: CVE-2025-21587 CVE-2025-30691 CVE-2025-30698 CVE-2025-30749 CVE-2025-30754...

gadgetinspector

This is a Java-based tool for finding deserialization gadget chains in Java applications. The tool is called "Gadget Inspector" and is presented as a project that was showcased at Black Hat USA 2018. The tool is designed to automatically discover possible gadget chains in an application's...

fastjson-remote-code-execute-poc

This is a Java-based proof-of-concept PoC exploit for a remote code execution RCE vulnerability in the FastJSON library, version 1.2.24. The exploit is designed to be used with IntelliJ IDEA, a popular integrated development environment IDE for Java development. The exploit consists of two main...

Exploit for CVE-2021-22006

It is an exploit module/toolkit targeting JNDI vulnerabilities. The primary CVE ID is CVE-2021-22006. The target product/service is Java-based applications, specifically those using JNDI services. The vulnerability class/vector is RCE Remote Code Execution, and the probable entry points are...

Exploit for Generation of Error Message Containing Sensitive Information in Postgresql

This is a PoC exploit for CVE-2021-3393, a Java source code static code analysis and danger function identifier program. The tool, named JavaID, identifies dangerous functions in Java source code by way of regular matching. It targets Java vulnerabilities such as XXE, Java Object Deserialization,...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...

The vulnerability of Oracle Java SE’s 2D software platform and the Oracle GraalVM virtual machine allows attackers to trigger a service failure.

The vulnerability of the Oracle Java SE 2D software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

unit-java -- security vulnerability

F5 reports: When NGINX Unit with the Java Language Module is in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization...

FreeBSD : unit-java -- security vulnerability (f6ca7c47-9190-11f0-b8da-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f6ca7c47-9190-11f0-b8da-589cfc10a551 advisory. F5 reports: When NGINX Unit with the Java Language Module is in use, undisclosed requests can lead to a...

The vulnerability of the Compiler component of the Oracle Java SE software platform and the Oracle GraalVM virtual machine allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Compiler component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to access control deficiencies. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected...

JNDIExploit

This is a Java-based exploit tool for JNDI Java Naming and Directory Interface injection vulnerabilities. The tool is designed to inject a payload into the JNDI repository, allowing an attacker to execute arbitrary code on the target system. The tool is based on the Rogue JNDI project and support...

ysoserial

This is a Java-based proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, named ysoserial, is designed to create gadgets that can be used to execute arbitrary commands on a vulnerable application. The gadgets are created by wrapping a...

CVE-2025-10252

A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation causes deserialization. The attack can only be done within the local network. The attack is considered to have high complexity. It is indicat...

marshalsec

It is an offensive tool for Java deserialization vulnerabilities. The repository contains a Java tool called "marshalsec" that exploits Java object deserialization vulnerabilities, allowing for remote code execution. The tool includes payload generators for various Java serialization libraries,...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Installation Manager and IBM Packaging Utility

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 11 used by IBM Installation Manager and IBM Packaging Utility. Vulnerability Details CVEID:CVE-2025-30754 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Security Bulletin: A vulnerability in IBM Java SDK (July 2025) affects IBM InfoSphere Information Server (CVE-2025-30754)

Summary There is a vulnerability in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. The issue was disclosed as part of the IBM Java SDK updates in July 2025. Vulnerability Details CVEID:CVE-2025-30754 DESCRIPTION: Vulnerability in the Oracle Jav...

com.liferay:com.liferay.my.account.web (>=1.0.0, <=1.0.12), com.liferay:com.liferay.portal.settings.web (>=1.0.0, <=1.2.4) potentially affected by CVE-2025-43787 via com.liferay:com.liferay.users.admin.web (>=1.0.0, <=2.3.0)

com.liferay:com.liferay.users.admin.web MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.2.4 Source cves: CVE-2025-43787 Source advisory: SNYK:JAVA-COMLIFERAY-12704859...

Security Bulletin: IBM Security SOAR is using components with multiple known vulnerabilities.

Summary IBM Security SOAR uses an older version of Java that may be identified and exploited. An update has been released which addresses these issues. CVE-2025-21587, CVE-2025-30698, CVE-2025-4447 Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE...

BIT-NIFI-2023-40037 Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custo...