java-vulnerable

Demo consumer for CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/ to ROLEADMIN → Rave chain...

Calibrated Decision Models for Autonomous Penetration-Testing Harnesses: JEV and Laya As System One Decision Layers for LLM-Driven Pentest Agents

Autonomous penetration-testing harnesses use large language models LLMs for reconnaissance, exploitation, and reporting, but often rely on those same models to confirm findings, grade severity, and select agents. This can lead to false positives, inflated severity, and wasted compute. We examine...

acids-msprior (>=1.0.1, <=1.1.3), acids-rave (>=2.1.16, <=2.3.1) +9 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.9.0)

pytorch-lightning PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - acids-msprior =1.0.1, =2.1.16, =0.0.2, =0.0.1, =0.2.6, =0.4.9, =0.4.0, =0.7.5 - swyft 0.4.2 - tencent-wedata-auto-ml 0.2.39...

Malicious code in @ravespaceio/rave-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4744e569e605ac6d749c8611417ad75dfd4d32f30fb6a75d5bcfa211d126bbd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @ravespaceio/rave-engine is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-6330 Malicious code in @ravespaceio/rave-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4744e569e605ac6d749c8611417ad75dfd4d32f30fb6a75d5bcfa211d126bbd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @ravespaceio/rave-engine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

acids-msprior (>=1.0.1, <=1.1.3), acids-rave (>=2.1.16, <=2.3.1) +9 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.0)

pytorch-lightning PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - acids-msprior =1.0.1, =2.1.16, =0.0.2, =0.0.1, =0.2.6, =0.4.9, =0.4.0, =0.7.5 - swyft 0.4.2 - tencent-wedata-auto-ml 0.2.39...

CVE-2013-1814

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...

acids-msprior (>=1.0.1, <=1.1.3), acids-rave (>=2.1.16, <=2.3.1) +9 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.9.0)

pytorch-lightning PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - acids-msprior =1.0.1, =2.1.16, =0.0.2, =0.0.1, =0.2.6, =0.4.9, =0.4.0, =0.7.5 - swyft 0.4.2 - tencent-wedata-auto-ml 0.2.39...

Apache Rave 0.20 User Information Disclosure

Apache Rave version 0.20 proof of concept user information disclosure exploit that leverages a flaw from 2013. ============================================================================================================================================= | Title : Apache Rave 0.20 Disclosure of use...

Apache Rave User Information Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Rave User Information Disclosure', 'Description' = %q This module exploits an information disclosure in Apache Rave 0.20 and prior. The...

Apache Rave information disclosure vulnerability

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...

org.apache.rave:rave-portal (>=0.11, <=0.20), org.apache.rave:rave-portal-dependencies (>=0.11, <=0.20) +2 more potentially affected by CVE-2013-1814 via org.apache.rave:rave-web (>=0.11, <=0.20)

org.apache.rave:rave-web MAVEN version =0.11, =0.11, =0.11, =0.11, =0.11, =0.20 Source cves: CVE-2013-1814 Source advisory: OSV:GHSA-428J-Q447-47RW...

org.apache.rave:rave-portal (>=0.11, <=0.20) potentially affected by CVE-2013-1814 via org.apache.rave:rave-portal-resources (>=0.11, <=0.20)

org.apache.rave:rave-portal-resources MAVEN version =0.11, =0.11, =0.20 Source cves: CVE-2013-1814 Source advisory: GHSA-428J-Q447-47RW...

org.apache.rave:rave-portal (>=0.11, <=0.20), org.apache.rave:rave-portal-dependencies (>=0.11, <=0.20) +2 more potentially affected by CVE-2013-1814 via org.apache.rave:rave-web (>=0.11, <=0.20)

org.apache.rave:rave-web MAVEN version =0.11, =0.11, =0.11, =0.11, =0.11, =0.20 Source cves: CVE-2013-1814 Source advisory: GHSA-428J-Q447-47RW...

GHSA-428J-Q447-47RW Apache Rave information disclosure vulnerability

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response...

org.apache.rave:rave-portal (>=0.11, <=0.20) potentially affected by CVE-2013-1814 via org.apache.rave:rave-portal-resources (>=0.11, <=0.20)

org.apache.rave:rave-portal-resources MAVEN version =0.11, =0.11, =0.20 Source cves: CVE-2013-1814 Source advisory: OSV:GHSA-428J-Q447-47RW...

com.google.code.maven-play-plugin.com.sienaproject.siena:siena (1.0.0-b6-20111107), ma.glasnost.orika:orika-tests (>=1.4.0, <=1.5.2) +5 more potentially affected by CVE-2022-23221 via com.h2database:h2 (1.3.154)

com.h2database:h2 MAVEN version 1.3.154 is affected by a known vulnerability. The following packages have a transitive dependency on com.h2database:h2 and may be impacted: - com.google.code.maven-play-plugin.com.sienaproject.siena:siena 1.0.0-b6-20111107 - ma.glasnost.orika:orika-tests =1.4.0,...

Yahoo Messenger 5.5 - Remote Exploit (DSR-ducky.c)

No description provided by source. / --- Remote yahoo Messenger V5.5 exploiter on Windows XP --- Dtors Security Research DSR Code by: Rave The buffer looks like this |-----| Fillup x offsetJMP 0x3EIPNOPSSHELLCODE ^^ / include windows.h include stdio.h include stdlib.h include string.h include...