4671 matches found
x-stream__xstream_CVE-2013-7285_1-4-6
XStream root@kitploit: "Java to XML Serialization, and back again" -- Binaries ----------------------------------------------- All binary artifacts are in the 'lib' directory. These include the xstream jars and any other library used at build time, or optional runtime extras. kXML2 is recommend...
pbtk
pbtk - Reverse engineering Protobuf apps Protobuf is a serialization format developed by Google and used in an increasing number of Android, web, desktop and more applications. It consists of a language for declaring data structures , which is then compiled to code or another kind of structure...
zkar
ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...
CVE-2025-55182-PoC
⚡ React2Shell Exploit PoC CVE-2025-66478 Next.js Remote Code Execution RCE via Prototype Pollution in Server Components 🕵️♂️ Overview This repository contains a Proof of Concept PoC for CVE-2025-66478 also referenced as CVE-2025-55182 in some contexts, a critical vulnerability affecting Next.js...
x-stream__xstream_CVE-2021-21345_1-4-15
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...
x-stream__xstream_CVE-2020-26217_1-4-14-java77
master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...
cve-2023-45612_exploit
cve-2023-45612exploit CVE-2023-45612 is a high severty security probem that allows XXE XML eXternal Entity attacks on Ktor's XML serialization that has been patched in 2023. Reproduction of the security problem Below is a detailed way of how I reproduced the problem. IntelliJ IDEA project First, ...
jenkins-cve-2016-0792
Jenkins CVE-2016-0792 Exploit for Jenkins serialization vulnerability - CVE-2016-0792 Exploit database https://www.exploit-db.com/exploits/42394/ More information can be found here 1. Contrast Security 2. Pentester Lab Requirements 1. Python 3.6.x 2. requests library is required for this exploit ...
LeakValue
Android 13 introduce muchas mejoras para endurecer el mecanismo de serialización Parcel Aquí está la presentación del equipo de Seguridad y Privacidad de Android sobre las mejoras realizadas Eso es genial, definitivamente elimina o vuelve inexplotables muchas vulnerabilidades. También describen...
CVE-2020-9496
CVE-2020-9496 - RCE Debido a que las 2 solicitudes relacionadas con xmlrpc en webtools xmlrpc y ping no utilizan autenticación, son vulnerables a deserialización insegura. Este problema fue reportado al equipo de seguridad por Alvaro Munoz [email protected] del equipo GitHub Security Lab. Es...
CVE-2023-38035-MobileIron-RCE
MobileIron CVE-2023-38035 Exploit README.md Description This bash script automates the process of scanning for vulnerable MobileIron systems that are susceptible to the CVE-2023-38035 exploit. The script performs multiple checks, including checking for required programs, downloading potential...
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig aka anteros-core. id: CVE-2020-9548 info: name: FasterXML Jackson Databind =2.9.10.4 - Remote Code Execution author: tomaquet18...
CVE-2017-13286
CVE-2017-13286 CVE-2017-13286 Poccannot use All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm The main cause of this vulnerability is the inconsistency between reading and writing of Parcel objects. It can be traced back to the following code root@kitploit: publ...
zkar
ZKar ZKar es una herramienta de análisis del protocolo de serialización de Java implementada en Go. Esta herramienta aún está en desarrollo , por lo que no hay una guía de API completa ni de contribución. ZKar proporciona: Un analizador y visor de cargas útiles de serialización de Java en Go puro...
freddy
Freddy, el asesino de la serialización - Buscador de errores de deserialización Una extensión de Burp Suite para ayudar a detectar y explotar librerías/API de serialización. Esta útil extensión fue desarrollada originalmente por Nick Bloor @nickstadb para NCC Group y se basa principalmente en el...
cve-2023-34040
CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...
sobelow
Sobelow Sobelow is a security-focused static analysis tool for Elixir & the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of points-of-interest. For project maintainers, it can be used to prevent the introduction of a number of common vulnerabilities...
XStream-1
master: v-1.4.x: XStream Serialización de Java a XML, y viceversa Binarios Todos los artefactos binarios están empaquetados en el archivo -bin. Incluye los jars de XStream y cualquier otra biblioteca utilizada en tiempo de compilación, o extras opcionales en tiempo de ejecución. Se recomienda el...
jenkins-cve-2016-0792
Jenkins CVE-2016-0792 Exploit para la vulnerabilidad de serialización de Jenkins - CVE-2016-0792 Base de datos de exploits https://www.exploit-db.com/exploits/42394/ Más información aquí 1. Contrast Security 2. Pentester Lab Requisitos 1. Python 3.6.x 2. La librería requests es necesaria para que...