CVE20131491-JIT

========================= Título ========================================= CVE-2013-1491 PoC usando JIT-Spray por Yuki Chen 古河 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Twitter: @guhe120 Weibo: http://weibo.com/u/1874932054 ========================= Acerca de este...

CVE-2019-0232

CVE-2019-0232 针对 Apache Tomcat - CGIServlet enableCmdLineArguments 远程代码执行（RCE）漏洞的分析与 PoC 视频 PoC 可在 https://www.youtube.com/watch?v=RA7kzuHOWqA 观看 详细信息 Apache Tomcat 的 CGI Servlet 存在一个漏洞，可被利用以实现远程代码执行（RCE）。只有在 Windows 上以非默认配置并结合批处理文件运行时，该漏洞才能被利用。 通用网关接口（CGI）是一种标准协议，允许 Web 服务器通过 Web...

CVE-2025-9435

ADManager Plus Build 7230 Elevation of Privilege CVE-2025-9435 Requirements A technician user with the 'Modify user general properties' role and logon access to the server where ADManager is installed. Description If the technician user has logon rights on the server , they can escalate privilege...

joern

Base de datos de consultas de Joern "Joern-Scan" Esta es la base de datos central de consultas para la plataforma de análisis de código abierto Joern. Tiene dos propósitos: Proporciona las baterías necesarias para convertir Joern en una herramienta de escaneo de código lista para usar. Sus...

buherablog-cve-2013-1488

Java Pwn2Own exploit - CVE-2013-1488 Exploit de prueba de concepto por axt basado en el informe de James Forshaw Afecta a versiones de JRE anteriores a 7u21...

CVE-2012-1889

CVE-2012-1889 This repository contains the files I used to learn about exploiting the CVE-2012-1889 vulnerability. root@kitploit: 1.txt First module info 2.txt Second module info c2javascript.c Used to convert C-form shellcode into JavaScript-form shellcode cve-2012-1889.html Exploit web page...

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...

CLSA-2026-1774484488 TuxCare security update for com.google.guava (1 CVE)

TuxCare rebuilt 4 com.google.guava packages to address 1 CVE. Fixed in 25.1-jre-tuxcare.1...

CLSA-2026-1773188139 TuxCare security update for com.google.guava (2 CVEs)

TuxCare rebuilt 5 com.google.guava packages to address 2 CVEs. Fixed in 27.1-jre-tuxcare.1...

BIT-JRE-2024-21147

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

BIT-JRE-2022-21366

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...

BIT-JRE-2021-35586

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: JRE built-in...

Security Bulletin: Communications Server (CS) for Data Center Deployment, CS for Linux, and CS for Linux on System z are affected by: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2026 - Includes Oracle January 2026 CPU

Summary Communications Server CS for Data Center Deployment, CS for Linux, and CS for Linux on System z install a local Java JRE in its product directories. This JRE is used solely for the IBM Key Manager ikeyman tool which is called by the snakeyman script used for managing the SSL key database...

Security Bulletin: Communications Server (CS) for Data Center Deployment and CS for AIX are affected by: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 - Includes Oracle October 2025 CPU

Summary Communications Server CS for Data Center Deployment and CS for AIX install a local Java JRE in its product directories. This JRE is used solely for the IBM Key Manager ikeyman tool which is called by the snakeyman script used for managing the SSL key database used by the TN3270 Server and...

Security Bulletin: Communications Server (CS) for Data Center Deployment, CS for Linux, and CS for Linux on System z are affected by: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2024 - Includes Oracle October 2024 CPU plus CVE-2024-10917

Summary Communications Server CS for Data Center Deployment, CS for Linux, and CS for Linux on System z install a local Java JRE in its product directories. This JRE is used solely for the IBM Key Manager ikeyman tool which is called by the snakeyman script used for managing the SSL key database...

RHSA-2026:4832 Red Hat Security Advisory: java-1.8.0-ibm security update

Bulletin has no description...

MiracleLinux 3 : java-1.6.0-openjdk-1.6.0.0-1.40.1.11.11.0.1.AXS3 (AXSA:2013-427:02)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-427:02 advisory. The OpenJDK runtime environment. Security issues fixed with this release: CVE-2013-0401 The Java Runtime Environment JRE component in Oracle Java SE ...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition (CVE-2025-53066, CVE-2025-53057)

Summary Multiple Vulnerabilities were disclosed as part of the JAVA October 2025 Critical Patch Update affecting IBM® SDK, Java™ Technology Edition in IBM License Key Server Administration and Reporting Tool ART and Administration Agent. For more information please refer to Oracle's CPU Advisory...

EUVD-2025-131906

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST/REST/UpdateJRE request payload...