CVE-2020-26259

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml root@kitploit: com.thoughtworks.xstream xstre...

CVE-2020-26259

Description XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. Influence Xstream \n" + " \n" + " \n" + " 0\n" + " \n" + " \n" + " \n" + " text/plain\n" + " \n" + " C:\Al1ex.txt\n" + " \n" + " \n" + " \n"...

CVE-2021-21349

CVE-2021-21349 XStream SSRF XStream आधिकारिक घोषणा CVE-2021-21349 भेद्यता CVE-2021-21349: XStream के साथ अनमार्शलिंग करके सर्वर-साइड फोर्जरी अनुरोध सक्रिय किया जा सकता है, जिससे इंट्रानेट या स्थानीय होस्ट में किसी संसाधन को संदर्भित करने वाले किसी भी URL से डेटा स्ट्रीम तक पहुँचा जा सकता है।...

Xstream-1.4.17

Xstream-1.4.17 بيئة Xstream Demo المذكورة أعلاه تم إعدادها من قبلي، بيئة استغلال الثغرات تعتمد على JDK1.8u131، وتدعم حاليًا الاختبار المحلي وإرسال الحزم عبر HTTP عن بُعد إعادة إنتاج ثغرات XSTREAM = 1.4.17 CVE-2021-39141، CVE-2021-39144، CVE-2021-39150، CVE-2021-39152 لا يتم توفير POC الخاص...

CVE-2021-21341

CVE-2021-21341 XStream DoS الإعلان الرسمي لـ XStream CVE-2021-21341 الثغرة CVE-2021-21341: يمكن أن يتسبب XStream في رفض الخدمة Denial of Service. الإصدارات المتأثرة جميع الإصدارات حتى الإصدار 1.4.15 وما يشمله متأثرة عند استخدام الإصدار بشكله الافتراضي out of the box. ولا يتأثر أي مستخدم اتبع...

GadgetProbe

Description You just found a Java deserialization bug, you ran all your ysoserial payloads, and.... you got nothing. What now? How can you debug or build a gadget chain if you're totally blind? Introducing GadgetProbe, a tool that shines a light on remote classpaths and raises bug severity for al...

marshalsec

Java Unmarshaller Security - आपके डेटा को कोड निष्पादन में बदलना यदि आप Log4Shell/CVE-2021-44228 के लिए यहाँ आए हैं, तो आप शोषण वैक्टर और प्रभावित Java रनटाइम संस्करणों के बारे में पढ़ना चाह सकते हैं: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ पेपर क्रिस फ्रोहॉफ और गेब्रियल...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. In XStream before version 1.4.16, there was a vulnerability where the processed stream at unmarshalling time contained type information that allowed new instances to be created based on those type information. An attacker...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. In XStream before version 1.4.16, there was a vulnerability where the processed stream at unmarshalling time contained type information that allowed new instances to be created based on those type information. An attacker...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15555

Technical details about CVE-2026-15555 are not publicly available in the provided documents. Monitor for updates on affected components, root cause specifics, vulnerable versions, and remediation guidance.

PT-2026-70091

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform affected versions not specified Description When the software runs with the -secmgr flag, the JDKBridge component of openjdk-orb processes attacker-supplied CDR Common Data Representation codebase URLs...

UBUNTU-CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

BIT-ACTIVEMQ-2026-53917 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message...

CVE-2026-53917

CVE-2026-53917 describes an unbounded memory allocation vulnerability in OpenWire property unmarshalling in Apache ActiveMQ and related builds. An authenticated user can send a crafted OpenWire Message with a very large encoded size value for a message property map, causing OpenWire maps to be un...

CVE-2026-53917 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message...

CVE-2026-53917 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the YAML unmarshalling process of the io.docker.server.metadata OCI image label into the catalog.Server struct. An attacker can execute arbitrary code as root on the host system by crafting a malicious O...