382 matches found
AutoGenerateXalanPayload
AutoGenerateXalanPayload Introduction This is an automated payload generation tool for the JDK Xalan overflow vulnerability CVE-2022-34169. It was created because different JDK versions require different overflow payloads. Running this tool with different JDK versions will generate different XSLT...
CVE-2020-35728
Description FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl. How to RCE pom.xml 4.0.0...
CVE-2026-33439-Python-PoC
CVE-2026-33439 Python PoC Автономный Python proof of concept для уязвимости удалённого выполнения кода до аутентификации в OpenAM при десериализации jato.clientSession. Встроенный shaded-гаджет Click/Xalan читает shell-команду из HTTP-заголовка cmd и возвращает её вывод в HTTP-ответе. Внешние...
CVE-2026-4813
CVE-2026-4813 CVSS-B 9.4 КРИТИЧЕСКИЙ Аутентифицированное RCE через XSLT-инъекцию в Lutece Core Пояснения и подробнее на моём сайте...
CVE-2026-88789
CVE-2026-88789 — Camel Quarkus: принудительно заданный Xalan TransformerFactory отменяет ограничения JAXP на внешний доступ Запускаемый proof-of-concept репродуктор уязвимости Apache Camel Quarkus, при которой расширение поддержки XSLT camel-quarkus-support-xalan предоставляет собственный...
CVE-2026-88789
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
EUVD-2026-90762
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-88789
The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...
Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_5726)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225726 advisory. OpenJDK: integer truncation issue in Xalan-J JAXP, 8285407 CVE-2022-34169 OpenJDK: class compilation issue Hotspot, 8281859 CVE-2022-21540 OpenJDK: imprope...
Rocky Linux 8 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_5683)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225683 advisory. OpenJDK: integer truncation issue in Xalan-J JAXP, 8285407 CVE-2022-34169 OpenJDK: class compilation issue Hotspot, 8281859 CVE-2022-21540 OpenJDK: imprope...
PT-2026-103830
Name of the Vulnerable Software and Affected Versions Apache Camel Quarkus versions 3.2.0 through 3.33.2 Apache Camel Quarkus versions 3.34.0 through 3.39.9 Description Improper restriction of XML External Entity XXE references in the XSLT support extension camel-quarkus-support-xalan allows an...
Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2022_5696)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225696 advisory. OpenJDK: integer truncation issue in Xalan-J JAXP, 8285407 CVE-2022-34169 OpenJDK: class compilation issue Hotspot, 8281859 CVE-2022-21540 OpenJDK: imprope...
CentOS Linux 8 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1770310264)
The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1770310264 advisory. - The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. Thi...
Astra Linux – Vulnerability in openjdk-11, bcel
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...
Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam
CVE-2026-33439 Python PoC Standalone Python proof of concept...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xalan-j2 (UTSA-2026-054046)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054046 advisory. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class...