CVE-2026-92142

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

EUVD-2026-88664

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-92142

Apache Karaf is vulnerable to an authorization bypass in its JMX MBeanServer due to a flaw in the KarafMBeanServerGuard. While the guard enforces role-based access control (RBAC) on certain operations, it fails to include the lifecycle methods createMBean, registerMBean, and unregisterMBean. This...

CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2022-23862

CVE-2022-23862: Escalada de privilegios local mediante JMX no autenticado en YSoft SafeQ El servicio JMX de SafeQ, que se ejecuta en el puerto 9696, es vulnerable a ataques JMX MLet. Debido a que el servicio no requería autenticación y se ejecutaba bajo el usuario “NT Authority\System”, pudimos...

SimpleRmiDiscoverer

SimpleRmiDiscoverer Herramienta simple de escaneo de JMX RMI Código completo: https://github.com/marcin-wolak/SimpleRmiDiscoverer/blob/master/SimpleRmiDiscoverer.java La herramienta ofrece las siguientes opciones para JMX de Java expuesto: Extraer el endpoint JMX IP/Nombre y puerto TCP del Regist...

mjet

mjet Mogwai Security Java Management Extensions JMX Exploitation Toolkit mjet es una herramienta que puede utilizarse para proteger servicios JMX configurados de forma insegura. Se basa en el artículo "Exploiting JMX-RMI" de Braden Thomas/Accuvant "http://www.accuvant.com/blog/exploiting-jmx-rmi"...

CVE-2023-26269

CVE-2023-26269: JMX mal configurado en Apache James Por defecto, Apache James abre un servicio JMXRMI que escucha en localhost, puerto 9999. Debido a que el JMX está mal configurado para permitir acceso no autenticado, un atacante que tenga acceso local a la máquina que ejecuta James puede utiliz...

CVE-2022-21306

CVE-2022-21306 POC, EXP, chatGPT for me, solo puedo dar algunas ideas, ninguno es funcional. code import json import requests targeturl = "http://127.0.0.1:7001" headers = 'User-Agent': 'Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/58.0.3029.110 Safari/537.3...

CVE-2018-14324-Exploit

Hackeando Eclipse GlassFish - CVE-2018-14324 La descripción de CVE-2018-14324 no explica completamente el impacto de esta vulnerabilidad. En resumen, tienes acceso a Java Management Extensions JMX mediante credenciales hardcodeadas admin:admin. Si bien el impacto se enumera como " información...

SCAT

SCAT Herramienta de adquisición de credenciales de HP SiteScope ¿Qué es esto? Una herramienta que abusa de una vulnerabilidad de ejecución remota de código en instalaciones predeterminadas de HP SiteScope v11.32 y otras para robar credenciales almacenadas en SiteScope. ¿Qué vulnerabilidad de...

CVE-2026-47858

CVE-2026-47858 — Spring Tools live information 模式未授权 JMX 远程代码执行（PoC） English README | 漏洞公告: Spring Security Advisory | CVE Record 漏洞 ：Spring Tools for Eclipse ≤ 5.2.0 / VSCode·Cursor·Theia ≤ 2.2.0 以 live information 模式 （默认开启）启动 Spring Boot 应用时，会向应用注入无认证、无 TLS、绑定全部网卡 的 JMX 远程参数。相邻网络的攻击者可以无凭据连接该 JM...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

CVE-2022-23862 affects Y Soft SAFEQ 6 Build 53. The SafeQ JMX service on port 9696 is vulnerable to JMX MLet attacks because authentication was not enforced and the service ran under NT AUTHORITY\System, enabling an attacker to execute arbitrary code and escalate to SYSTEM locally. Public PoC and...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

YSoft SAFEQ 访问控制错误漏洞

YSoft SAFEQ is an enterprise print management suite solution platform from the Czech company YSoft. A security vulnerability exists in YSoft SAFEQ that stems from SafeQ JMX not enforcing authentication, resulting in vulnerability to JMX MLet attacks...

CVE-2022-23862: Missing Authentication for Critical Function

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...