200 matches found
lazylist-cve-poc
Gerador de payload CVE-2022-36944 Este mini-projeto foi criado para demonstrar a prova de conceito da vulnerabilidade CVE-2022-36944. É semelhante ao ysoserial, mas gera payload apenas para este CVE com a classe LazyList. FAQ Rápida Quais artefatos trazem a vulnerabilidade?...
CVE-2025-60012-POC
Apenas para fins educacionais e de pesquisa em segurança. Não utilize contra sistemas que você não possui ou para os quais não tenha permissão explícita por escrito para testar. →Isenção de Responsabilidade Completa CVE-2025-60012 — Apache Livy: Acesso Não Autorizado a Arquivos -yellow Visão Gera...
CVE-2025-66249-POC
CVE-2025-66249 — Bypass della whitelist di Path Traversal in Apache Livy Solo per scopi educativi e di ricerca sulla sicurezza. Non utilizzare contro sistemi di cui non sei proprietario o per i quali non hai esplicita autorizzazione scritta a effettuare test. →Dichiarazione di non responsabilità...
GHSA-93J5-89VC-PPH4 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, thingsboard, druid, zipkin...
EUVD-2026-57635
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject...
GHSA-M2PW-22CJ-JQ4V
creationtimestamp| type| source ---|---|--- 2026-08-10 21:27:13+00:00| seen| https://bsky.app/profile/scala-lang.org/post/3msr24brbfc2h...
ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman-core_2.12 (0.0.5) +148 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=1.0-234-d1a2b53)
org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.30 and more Source cves: CVE-2026-73493 Source advisory: SNYK:JAVA-ORGHTTP4S-18313134...
ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +231 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-core_2.12 (>=0.10.0-m10, <=1.0-234-d1a2b53)
org.http4s:http4s-blaze-core2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.19.3 and more Source cves: CVE-2026-73493 Source advisory: SNYK:JAVA-ORGHTTP4S-18313135...
ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman-core_2.12 (0.0.5) +148 more potentially affected by CVE-2026-73495 via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=1.0-234-d1a2b53)
org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.30 and more Source cves: CVE-2026-73495 Source advisory: SNYK:JAVA-ORGHTTP4S-18313125...
ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman-core_2.12 (0.0.5) +148 more potentially affected by unknown CVE via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=1.0-234-d1a2b53)
org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.30 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-ORGHTTP4S-18313139...
ROOT-APP-MAVEN-CVE-2022-36944 CVE-2022-36944 in io.root.org.scala-lang:scala-library - Patched by Root
Root has patched CVE-2022-36944 in the io.root.org.scala-lang:scala-library package for Root:Maven. Multiple fixed versions available...
OS Command Injection
sbt is vulnerable to OS Command Injection. The vulnerability is due to the lack of validation of the URI fragment, where a malicious fragment can execute arbitrary commands because cmd /c interprets &, |, and ; as command separators...
CVE-2026-32948 sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without...
EUVD-2026-14990
sbt: Source dependency feature via crafted VCS URL leads to arbitrary code execution on Windows...
GHSA-X4FF-Q6H8-V7GW sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Summary On Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious...
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Summary On Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious...
Command Injection
Overview org.scala-sbt:main2.11 is a sbt is an interactive build tool Affected versions of this package are vulnerable to Command Injection in the Process"cmd", "/c", ... used to execute VCS commands on Windows when handling user-controlled URI fragments. An attacker can execute arbitrary Windows...
EUVD-2019-0212
Malware in sbrugna...