CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 演示测试 请立即升级 spring data rest。 步骤 启动本应用 创建 test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用 spel 注入，会启动 C:\Windows\system32\calc.exe PATCH /entityPersons/1 HTTP/1.1 Host:...

CVE-2017-8046

免责声明： 本仓库是对 VGS 博文《如何避免使用已知漏洞的组件》的补充。它包含一个具有已知安全漏洞（即 CVE-2017-8046）的应用程序，以及如何利用该漏洞的描述。请自行承担使用该应用程序的风险！ 设置 首先，在仓库根目录执行以下命令启动应用程序： mvn clean spring-boot:run 然后，通过发送如下 POST 请求创建一个资源： curl -X POST http://localhost:8080/books \ -H 'Content-Type: application/json' \ -d...

CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC 此存储库是Spring官方安全公告公开的 CVE-2026-41729 的最小复现PoC。 官方公告：https://spring.io/security/cve-2026-41729/ 官方标题：Spring Data REST SpEL Injection via Map Key in JSON Patch 严重级别：High CVSS v3.1：AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 公开日期：2026-06-...

CVE-2026-86512

A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality...

CVE-2026-86319

A flaw was found in java-json-tools json-patch. A remote attacker can exploit a vulnerability in the JsonPatch.apply function within the Patch Operation Handler component. By manipulating input, an attacker can cause excessive resource consumption, leading to a Denial of Service DoS condition...

CVE-2026-86318

A flaw was found in java-json-tools json-patch. A remote attacker could exploit a stack-based buffer overflow vulnerability in the JsonMergePatch.fromJson function by sending specially crafted JSON input. This could lead to a denial of service, making the affected system unavailable. Mitigation...

CVE-2026-86512

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86512 java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86512

CVE-2026-86512 affects java-json-tools json-patch versions up to 1.13 , specifically the CopyOperation.apply and MoveOperation.apply functions in the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java (Copy Move Operations component). The root cause is improper access controls , enabl...

CVE-2026-86512 java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

EUVD-2026-72613

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86512 java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

PT-2026-86980

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86512: Improper Access Control

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86318

A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published a...

CVE-2026-86319

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...

CVE-2026-86319

A resource consumption vulnerability in the json-patch Java library (versions up to 1.13 ) affects the JsonPatch.apply function in the Patch Operation Handler component. An attacker can trigger it remotely with no authentication or user interaction, resulting in a denial-of-service condition. The...

CVE-2026-86319 java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...

CVE-2026-86319 java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...

CVE-2026-86319 java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...