log4j-lookups-vulnerability

log4j-lookups-vulnerability 该项目基于 spring-boot，代码揭示了 Log4j2 漏洞（CVE-2021-44228）的工作原理。 针对 CVE-2021-44228 的解决方案见以下链接 https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot...

CVE-2022-42889-PoC

CVE-2022-42889 又名 Text4Shell RCE 概念验证 Text4Shell 是 Apache Commons Text 库中发现的一个严重软件漏洞的俗称（参见 CVE-2022-42889）。 本仓库旨在演示利用此 CVE 的远程代码执行 （RCE）。 该易受攻击的代码 用于 SpringBoot 控制器中，但请不要混淆，这不是 SpringBoot/Spring 安全问题。 在测试 RCE 之前，请构建 Docker 镜像： $ docker build -t text4shell . ... = exporting to image 0.0s = =...

cve-2022-42889-text4shell

Mavenのインストール - maven-linux 1. fat jarを作成するためにMavenをインストール mvn clean install 2. Dockerビルド docker build --tag=text4shell . 3. Dockerの実行 docker run -p 80:8080 text4shell 4. アプリをテスト http://localhost/text4shell/attack?search= 5. 攻撃は、前述のルックアップのプレフィックスである文字列“$prefix:name”を渡すことで実行できます:...

text4shell-cve-2022-42889

Text4Shell CVE-2022-42889 针对CVE-2022-42889的Docker实验环境 你可以选择在本地构建Docker镜像，或从Docker Hub拉取镜像并运行容器。 克隆仓库 git clone https://github.com/devenes/text4shell-cve-2022-42889.git 在本地构建Docker镜像 docker build --tag=text4shell . 运行Docker容器 docker run -d --rm -p 8080:8080 text4shell 或者从Docker Hub拉取镜像并运行容器 docker...

Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228 in Apache Solr Vulhubhttps://vu...

CVE-2026-87803

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-87803

CVE-2026-87803 is an authorization bypass in Countly Server DBViewer caused by flawed sub-pipeline detection in the aggregation stage sanitizer at the /o/db endpoint. When the sanitizer encounters an unrecognized key such as the undocumented MongoDB-internal $_internalInhibitOptimization, it misc...

PT-2026-89354

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

AlmaLinux 9 : buildah (ALSA-2022:8008)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8008 advisory. - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is...