spring4shell-poc

Spring4Shell POC Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run...

net.sf.mgp:maven-gwt-plugin (>=1.0, <=1.5.0), org.apache.portals.jetspeed-2:jetspeed-mvn-maven-plugin (>=2.2.0, <=2.3.1) potentially affected by CVE-2025-67030 via org.codehaus.plexus:plexus-utils (1.5)

org.codehaus.plexus:plexus-utils MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - net.sf.mgp:maven-gwt-plugin =1.0, =2.2.0, =2.3.1 Source cves: CVE-2025-67030 Source advisory:...

MAL-2026-1202 Malicious code in mvn-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7439c73d7a34dad9485537cc4adefa71514a16e38e08a171c099933110bfa5c The package mvn-runtime was found to contain malicious code. Source: ghsa-malware 3af620cf3afd7a0d522823f8835bdf289b697f5be39cf61e22e7f1f0da6ec7aa An...

Malicious code in mvn-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7439c73d7a34dad9485537cc4adefa71514a16e38e08a171c099933110bfa5c The package mvn-runtime was found to contain malicious code. Source: ghsa-malware 3af620cf3afd7a0d522823f8835bdf289b697f5be39cf61e22e7f1f0da6ec7aa An...

Malicious Package

Overview mvn-runtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malware in mvn-runtime

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-47197: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype...

Exploit for Out-of-bounds Write in Hutool

json.org CVE-2022-45688 false positive The project contains...

Exploit for Out-of-bounds Write in Hutool

json.org CVE-2022-45688 false positive The project contains...

Exploit for Out-of-bounds Write in Hutool

json.org CVE-2022-45688 true positive The project illustrate...

net.sf.mgp:maven-gwt-plugin (>=1.0, <=1.5.0), org.apache.portals.jetspeed-2:jetspeed-mvn-maven-plugin (>=2.2.0, <=2.3.1) potentially affected by CVE-2022-4245 via org.codehaus.plexus:plexus-utils (1.5)

org.codehaus.plexus:plexus-utils MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - net.sf.mgp:maven-gwt-plugin =1.0, =2.2.0, =2.3.1 Source cves: CVE-2022-4245 Source advisory:...

net.sf.mgp:maven-gwt-plugin (>=1.0, <=1.5.0), org.apache.portals.jetspeed-2:jetspeed-mvn-maven-plugin (>=2.2.0, <=2.3.1) potentially affected by CVE-2022-4244 via org.codehaus.plexus:plexus-utils (1.5)

org.codehaus.plexus:plexus-utils MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - net.sf.mgp:maven-gwt-plugin =1.0, =2.2.0, =2.3.1 Source cves: CVE-2022-4244 Source advisory:...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +55 more potentially affected by CVE-2022-22984 via snyk-mvn-plugin (>=2.0.0, <=2.31.2)

snyk-mvn-plugin NPM version =2.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =0.2.8 and more Source cves: CVE-2022-22984 Source advisory: GHSA-4X6G-3CMX-W76R...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +55 more potentially affected by CVE-2022-22984 via snyk-mvn-plugin (>=2.0.0, <=2.31.2)

snyk-mvn-plugin NPM version =2.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =0.2.8 and more Source cves: CVE-2022-22984 Source advisory: OSV:GHSA-4X6G-3CMX-W76R...

CVE-2022-22984: Improper Neutralization of Special Elements used in an OS Command

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +67 more potentially affected by CVE-2022-22984 via snyk-mvn-plugin (>=1.0.0, <=2.31.2)

snyk-mvn-plugin NPM version =1.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.7, =1.0.1 - @ericblade/quagga2-redux-middleware 1.0.1 and more Source cves: CVE-2022-22984 Source advisory: MEND:CVE-2022-22984...

CVE-2022-22984

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +55 more potentially affected by CVE-2022-22984 +1 more via snyk-mvn-plugin (>=2.0.0, <=2.31.2)

snyk-mvn-plugin NPM version =2.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =0.2.8 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKMVNPLUGIN-3038623...

net.sf.mgp:maven-gwt-plugin (>=1.0, <=1.5.0), org.apache.portals.jetspeed-2:jetspeed-mvn-maven-plugin (>=2.2.0, <=2.3.1) potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.5)

org.codehaus.plexus:plexus-utils MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - net.sf.mgp:maven-gwt-plugin =1.0, =2.2.0, =2.3.1 Source cves: CVE-2017-1000487 Source advisory:...

org.openapitools:openapi-generator-gradle-plugin (3.0.1), org.openapitools:openapi-generator-gradle-plugin-mvn-wrapper (3.0.1) +2 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (3.0.1)

org.openapitools:openapi-generator MAVEN version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapitools:openapi-generator-gradle-plugin 3.0.1 -...