639 matches found
snakeyaml_cve_poc
snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC Сборка Вы можете собрать jar на вашем хост-компьютере с помощью mvn clean compile assembly:single Или используйте docker для создания образа командой docker build -t snakeyaml . Запуск Запустите контейнер командой docker run --rm -p8080:8080 snakeyaml и...
CVE-2020-1947
CVE-2020-1947 ApacheShardingShpereUIYAML: воспроизведение и анализ уязвимости удалённого выполнения кода при разборе YAML Обзор Проект shardingsphere — это открытая экосистема Apache, представляющая собой набор решений промежуточного ПО для распределённых баз данных. Он состоит из трёх независимы...
CVE-2022-31691
CVE-2022-31691 Un resoconto del mio esame finora inconcludente su CVE-2022-31691. Contesto Sono un utente frequente di Spring Tool Suite STS per Eclipse e tendo a farci affidamento per inizializzare nuovi progetti Spring Boot. Questa vulnerabilità vedi...
SnakeYAML-CVE-2022-1471-POC
SnakeYAML-CVE-2022-1471-POC Code für den Veracode Blog Um die Code-Ausführung zu demonstrieren, 1. Baue das Projekt mit Maven 2. Führe python3 -m http.server 8080 aus, um den HTTP-Server zu starten 3. Führe exploit.java aus. Du solltest eine HTTP-GET-Anfrage auf dem Server sehen 4. Um zu...
cve-2022-1471-jira-lab
CVE-2022-1471 — Lab RCE SnakeYAML contesto Jira / Automation for Jira Lab offline e autonomo che dimostra il meccanismo alla base di CVE-2022-1471 deserializzazione non sicura SnakeYAML → RCE, CVSS 9.8, come sfruttato nel finding su Jira / Jira Service Management contro un host con 9.4.9 range...
CVE-2025-56815
CVE-2025-56815 Datart 1.0.0-rc.3 è vulnerabile a Directory Traversal nell'interfaccia POST /viz/image, poiché il server utilizza direttamente MultipartFile.transferTo per salvare il file caricato in un percorso controllabile dall'utente e non effettua una verifica rigorosa del nome del file...
seans-surf-and-skate
Sean's Surf & Skate Co. — Seal Security Demo Maven / Java Ein kleiner, aber realistisch wirkender E-Commerce-Storefront „Sean's Surf & Skate Co.“, gebaut mit Spring Boot. Er wird mit bekannt anfälligen Open-Source-Abhängigkeiten ausgeliefert, so dass er verwendet werden kann, um zu demonstrieren,...
yaml-payload
yaml-payload Un payload di sfruttamento della deserializzazione SnakeYAML per CVE-2022-1471 , adattato da artsploit/yaml-payload originariamente basato su mbechler/marshalsec. Cosa fa Quando viene caricato tramite l'insicuro Yaml.load di SnakeYAML, questo payload prende il controllo...
yaml-payload
yaml-payload Un payload di deserializzazione SnakeYAML per CVE-2022-1471 , adattato da artsploit/yaml-payload basato originariamente su mbechler/marshalsec. Cosa fa Quando caricato tramite l'uso non sicuro di Yaml.load di SnakeYAML, questo payload prende il controllo dell'applicazione in esecuzio...
Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml
CVE-2022-1471 — SnakeYAML RCE lab Jira / Automation for Jira...
ROOT-APP-MAVEN-CVE-2022-1471 CVE-2022-1471 in io.root.org.yaml:snakeyaml - Patched by Root
Root has patched CVE-2022-1471 in the io.root.org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available...
Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.
Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, SnakeYAML, Spring Beans, Logback Classic and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring...
osv-java-poc
OSV Scanner CVE Detection POC — Vulnerable Java App ⚠️ WA...
Astra Linux – Vulnerability in snakeyaml
The package org.yaml:snakeyaml in versions 0 and earlier than 1.31 is vulnerable to Denial of Service DoS attacks due to a missing nested depth limitation in collections...
Astra Linux – Vulnerability in snakeyaml
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow...
Astra Linux – Vulnerability in snakeyaml
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow...
Astra Linux – Vulnerability in snakeyaml
Those who use Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser runs on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow. This vulnerability could potentially allow for a Denial of...
Astra Linux – Vulnerability in snakeyaml
The Alias feature in SnakeYAML before version 1.26 allowed entity expansion during a load operation, which is a related issue to CVE-2003-1564...
Astra Linux – Vulnerability in snakeyaml
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow...
RCE (Remote Code Execution) org.yaml:snakeyaml Dependency in Confluence Data Center
This Confluence release includes updates to our org.yaml:snakeyaml dependency in response to CVE-2022-1471. Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for...