CVE-2023-21939

JDK CVE-2023-21939 文章链接 This is JDK CVE-2023-21939 Use JDK version lower than 8u371 JDK + Apache XML Graphics org.apache.xmlgraphics batik-swing 1.15 How to reproduce this RCE: 1 Run XmlServer.java 2 Run JarServer.java 3 Run JarRCE.java for Test and successfully RCE Screenshot: JDK + Apache XML...

CVE-2022-39197-patch

CVE-2022-39197 patch CVE-2022-39197 Cobalt Strike XSS 漏洞的一个临时补丁 通过 hook javax.swing.plaf.basic.BasicHTML的isHTMLString方法来禁用swing的html支持 PS: 部分依赖html的页面无法正常渲染例如 关于页面 使用方法 将 patch.jar 放入cobaltstrike启动目录下 在cobaltstrike启动参数中加入javaagent 启用补丁 -javaagent:patch.jar 启动cobaltstrike 输出Successfully Patched...

cobaltstrike_swing_xss2rce

This repository does not have a README...

androrat

androrat Remote Administration Tool for Android Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT Remote Access Tool. It has been developed in a team of 4 for a university project. ...

Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1898)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231898 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 8 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1895)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231895 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 8 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2021_3891)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213891 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using Kerberos...

Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2021_3893)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213893 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using Kerberos...

Rocky Linux 9 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1880)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231880 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 9 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1909)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231909 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Swing. The supported versions affected by this vulnerability include Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5, and 22.3....

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

EUVD-2026-56044

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

The CVE-2026-72605 entry concerns Swing Music 3.0.0 with a missing authentication flaw: the POST /auth/profile/create endpoint is allowlisted from JWT verification, enabling unauthenticated remote attackers to create arbitrary user accounts. This can lead to attackers registering accounts and gai...