EXPLOIT-CVE-2026-40901

DataEase — RCE sans authentification via une chaîne de 4 vulnérabilités CVE-2026-40901 et autres Contournement d'authentification → contournement de la liste noire JDBC lecture arbitraire de fichiers → injection SQL → Désérialisation Java dans Quartz → exécution de code à distance en tant queroot...

Quartz-1

Pour compiler : % mvn install -DskipTests Remarque : a. le jar final de Quartz se trouve dans quartz/target b. si vous ne disposez pas des jars des bibliothèques tierces Oracle et/ou Weblogic nécessaires à la compilation ils ne sont pas disponibles sur les dépôts Maven publics en raison des...

Cybersecurity-Handbook

📚 Cybersecurity Handbook An open-source cybersecurity knowledge base for students, professionals, and self-learners — built as structured notes, hands-on labs, and real-world concepts you can search and navigate visually. Built with Quartz • Powered by Markdown • Community Driven • MIT Licensed...

CVE-2026-84862

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-84862

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization within the Quartz JDBC job store (CWE-502). An authenticated attacker could exploit this flaw to execute arbitrary code on the affected system. IBM has addressed this vulnerability in an update; customers are encouraged t...

CVE-2026-84862 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-84862 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

EUVD-2026-87106

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

PT-2026-98854

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Insecure deserialization occurs in the Quartz JDBC job store. An authenticated attacker can exploit this flaw to execute arbitrary code on the affected system. Deserialization is the proces...

CVE-2026-84862: Deserialization of Untrusted Data

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

Astra Linux – Vulnerability in Jackson-Databind

A deserialization flaw was discovered in Jackson-Databind through version 2.9.10.4. This flaw could allow unauthenticated users to execute code via Ignite-JTA or Quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and...

Malicious Package

Overview quartz-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

MAL-2026-15671 Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

CLSA-2026-1778028240 TuxCare security update for org.quartz-scheduler (1 CVE)

TuxCare rebuilt 5 org.quartz-scheduler packages to address 1 CVE. Fixed in 1.8.5-tuxcare.1...

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

The vulnerability of the quartz.dll file in the Windows DirectShow operating system, allowing a hacker to execute arbitrary code

The vulnerability of the quartz.dll file in the Windows DirectShow operating system is related to the improper handling of zero bytes or the Nul character during data exchange. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created QuickTime med...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: quartz (UTSA-2026-016722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016722 advisory. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Tenable has extracte...

Microsoft DirectX NULL Byte Overwrite Vulnerability

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file...

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...