log4j-docker-vaccine

Log4j Docker Vaccine A containerized way to run the log4j vaccine offered by Cyberreason https://github.com/Cybereason/Logout4Shell Make it go Clone this repo: git clone https://github.com/jeffbryner/log4j-docker-vaccine.git Edit the containers.env file to hold an accurate private or public IP/DN...

cloudrasp-log4j2

CloudArmor · Runtime Application Self-Protection Module - Log4j2 Version 简体中文 This project is a local version from CloudArmor specifically built for defending Log4j2 CVE-2021-44228 . No network connection is required to run this project. Please DO TESTING before deploying it to production...

log4j2-exploit

Log4Shell CVE-2021-44228 proof of concept Requirement Java JDK/JRE 8 or later version curl exploitable Simple spring boot application that serves a login page with user and password. It logs the user name when POSTed to /. It is not required for the application to log any user provided input...

jndi-ldap-test-server

jndi-ldap-test-server This is a minimalistic LDAP server that is meant for test vulnerability to JNDI+LDAP injection attacks in Java, especially CVE-2021-44228. How to test vulnerability to CVE-2021-44228 1. Download the test server binary for your platform you can find all binaries under Release...

CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

CVE-2020-9495

CVE-2020-9495 PoC CVE-2020-9495 is medium severity LDAP injection vulnerability in Apache Archiva versions before 2.2.5. It allows an attacker to retrieve any LDAP attribute values of users that exist on the LDAP server. From the official Apache Archiva advisory: By providing special values to th...

CVE-2021-44228-Log4j-lookup-Rce

0x01, Entorno Jdk7u21（cualquier versión sirve） Versiones afectadas: Apache Log4j 2.x org.apache.logging.log4j log4j-core 2.11.1 Poc import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; public class test2 private static Logger LOGGER = LogManager.getLogger; public...

CVE-2021-44228-PoC-log4j-bypass-words

🤝 Show your support - give a ⭐️ if you liked the content | SHARE on Twitter | Follow me on 🐱‍💻 ✂️ 🤬 LOG4J Java exploit - WAF and patches bypass tricks 📝 Description CVE-2021-44228 works on: log4j: 2.0 = Apache log4j = 2.14.1 Java version already patched: 6u211+, 7u201+, 8u191+, 11.0.1+. Windows...

CVE-2026-42568

CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule Summary An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing authentication bypass. Field| Value ---|--- CVE|...

CVE-2021-29156

CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security Charlton Trezevant [email protected] Background Today GuidePoint is pleased to release a functional Proof-of-Concept tool for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. This vulnerability allows an...

python-log4rce

Python Log4RCE An all-in-one pure Python3 PoC for CVE-2021-44228. Sample python3 log4rce.py --target "linux" --payload "PAYLOAD" http -X POST --url "http://localhost:8080/" --data "address=" INFO:HTTP:Running on local port 1337 INFO:HTTP:Remote target is http://127.0.0.1:1337/LinuxExploit.class...

vmware_vcenter_cve_2020_3952

Proof of concept for CVE-2020-3952 This is a short piece of code that exploits of CVE-2020-3952, which is described in detail at the Guardicore Labs post over here. This vulnerability was published by VMware in April 2020 with a maximum CVSS score of 10.0. It allows an attacker with a network...

vmware_vcenter_cve_2020_3952

Prueba de concepto para CVE-2020-3952 Este es un breve fragmento de código que explota CVE-2020-3952, el cual se describe en detalle en la publicación de Guardicore Labs aquí. Esta vulnerabilidad fue publicada por VMware en abril de 2020 con una puntuación CVSS máxima de 10.0. Permite a un atacan...

CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053 Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053

The Apache MINA SSHD Java library is vulnerable to an authentication bypass via LDAP injection within the optional sshd-ldap component. The root cause is a lack of proper escaping for LDAP filter metacharacters, which allows an attacker to successfully authenticate using the username "" and passw...

EUVD-2026-89757

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

CVE-2026-94053

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...

securenvoy-cve-2024-37393

securenvoy-cve-2024-37393 RESPONSIBLE DISCLOSURE Vulnerability check script for CVE-2024-37393 SecurEnvoy MFA 9.4.513. Proof of concept code for checking LDAP injection. Fix Vulnerability fixed in SecurEnvoy MFA = 9.4.514. Links https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393 Autho...

SecurEnvoy Two Factor Authentication - LDAP Injection

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the...