13 matches found
CVE-2022-22965
CVE 2022-22965Spring4Shell 分析 漏洞描述 Spring4Shell 是存在于 Spring Framework 的 Spring Core 上的一个 CVE 的名称。 其 CVSS 3.x 评分为 9.8，该漏洞被列为最高风险等级（critical）。该漏洞允许攻击者远程执行利用代码并控制存在漏洞的服务器。 鉴于 Spring Core 在互联网上的普及程度以及 Spring4Shell 的严重影响，专家们评估该漏洞的影响力不亚于 Log4shell。 影响范围 Spring4Shell 并不会影响互联网上所有使用 Spring Framework 的 Web...
CVE-2020-14645
CVE-2020-14645 Weblogic CVE-2020-14645 UniversalExtractor JNDIインジェクション getDatabaseMetaData プロジェクトは https://github.com/5up3rc/weblogiccmd に依存しています。 デモ 要件 1. JDKバージョン JDK6u211/7u201/8u191 2. Weblogicバージョン 12.2.1.4.0 違法に使用しないでください!!!!!!!! 参考 1. https://www.anquanke.com/post/id/210724 2...
spring-core-rce
Spring Core RCE/CVE-2022-22965 影响范围：JDK=9 的spring框架及衍生框架 文章指路 脚本仅供学习使用，如作他用所承受的法律责任一概与作者无关 1.installation root@kitploit: pip3 install -r requirements.txt 2.Usage root@kitploit: $ python3 spring-core-rce.py -h .----..-.-. .---. .-..-. .-..----. .----. .---. .---. .----. .---. .----..----. -| || \ ...
CLSA-2026-1777645704 java-17-openjdk: Fix of 2 CVEs
Update to jdk-17.0.19+10 RHSA-2026:9686 - Set fipsver to 62c0f885e30 - CVE-2026-22016: fix JAXP component vulnerability allowing unauthenticated remote attackers to gain unauthorized access to sensitive data in Java SE - CVE-2026-34282: fix Hotspot component vulnerability allowing unauthorized...
CVE-2025-5662
A deserialization vulnerability exists in the H2O-3 REST API POST /99/ImportSQLTable that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution RCE due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present i...
PT-2025-29620 · Oracle · Oracle Graalvm For Jdk +1
Name of the Vulnerable Software and Affected Versions: Oracle GraalVM for JDK version 24.0.1 Description: A difficult-to-exploit issue exists in the Oracle GraalVM for JDK product of Oracle Java SE component: Native Image. An unauthenticated attacker with network access via HTTP can compromise...
SUSE-SU-2025:1399-1 Security update for java-11-openjdk
This update for java-11-openjdk fixes the following issues: Upgrade to upstream tag jdk-11.0.27+6 April 2025 CPU CVEs: + CVE-2025-21587: Fixed JSSE unauthorized access, deletion or modification of critical data bsc1241274 + CVE-2025-30691: Fixed Oracle Java SE Compiler Unauthorized Data Access...
PT-2023-9571
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23 Oracle GraalVM for JDK versions 17.0.12, 21.0.4, 23 Oracle GraalVM Enterprise Edition versions 20.3.15, 21.3.11 Description The issue is related to the Serialization...
CVE-2023-5763
In Eclipse Glassfish 5 or 6, running with old versions of JDK lower than 6u211, or 7u201, or 8u191, allows remote attackers to load malicious code on the server via access to insecure ORB listeners...
GHSA-GVG3-83Q4-RFHQ Command injection in Apache Sling
Apache Sling JCR Base 3.1.12 has a critical injection vulnerability when running on old JDK versions JDK 1.8.191 or earlier through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDN...
Exploit for Code Injection in Vmware Spring_Framework
Spring-Core-RCE Spring Framework Remote Command Execution Vuln...