61 matches found
Oracle-WebLogic-CVE-2017-10271-master
WebLogic Wls-wsat XMLDecoder Descripción de la vulnerabilidad mitre:https://vulners.com/cve/CVE-2017-3506 En las primeras etapas, los atacantes aprovecharon las vulnerabilidades del componente WLS de WebLogic para lanzar ataques remotos a gran escala contra servidores empresariales. Se...
CVE-2017-10271
Identificación y explotación de CVE-2017-10271. RCE no autenticado en Weblogic. https://nvd.nist.gov/vuln/detail/CVE-2017-10271 https://www.oracle.com/technetwork/topics/security/cpuoct2017-3236626.html root@kitploit: POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: SOMEHOSTHERE Content-Length:...
weblogic-XMLDecoder
Este software se utiliza únicamente para aprendizaje e intercambio, prohibido cualquier uso ilegal Weblogic-XMLDecoder-GUI CVE-2017-10352 Trabajo experimental basado en Python GUI, función principal para explotar la vulnerabilidad de deserialización causada por Weblogic XMLDecoder. El objetivo de...
Oracle-WebLogic-CVE-2017-10271
WebLogic Wls-wsat XMLDecoder Descripción de la vulnerabilidad mitre:https://vulners.com/cve/CVE-2017-3506 Anteriormente, los hackers aprovecharon la vulnerabilidad del componente WLS de WebLogic para lanzar ataques remotos a gran escala contra servidores empresariales. Gran cantidad de servidores...
WeblogicScan
WeblogicScan Weblogic一键漏洞检测工具，V1.5 root@kitploit: 软件作者：TideRabbitMask 免责声明：Pia!ｏ ‵-′ノ”ノ﹏py3升级造成） Not End： 话说大家一直好奇其它同类型工具增加的CVE-2020- 为什么一直没有在这里出现。 其实相关的漏洞利用链以及最新的EXP我都有自己去复现或自己去写，手头也差不多是全的， 但是如何把他们去靠谱的自动化集成一直是个问题，很多公开利用链是依赖ldap或没有回显可供正则的。 : 至于1.4高度封装与框架重新设计的目的，V1.5批量版本近期更新，敬请期待。 V 1.5 更新日志:...
CVE-2017-10271
LAB 2 - CVE-2017-10271: WebLogic XMLDecoder Deserialization Writeup I. System Analysis System Log Analysis Detected Service: Oracle WebLogic Server AdminServer belonging to basedomain running in Development Mode. Connection Port: 7001. Supported Protocols: http, t3, iiop, ldap, snmp. Attack Surfa...
CVE-2017-3506
¿Qué es esto? Esto es una PoC de CVE-2017-3506 Serialización de Weblogic XMLDecoder ¿Cómo usarlo? comprobar vul root@kitploit: java -jar WebLogic-XMLDecoder.jar -u http://192.168.174.144:7001 GetShell root@kitploit: java -jar WebLogic-XMLDecoder.jar -s http://192.168.174.144:7001...
io.netty/netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability
A flaw was found in Netty, a network application framework. A remote attacker could exploit this vulnerability by sending specially crafted XML data containing a DOCTYPE declaration to a vulnerable XmlDecoder within the Netty channel pipeline. This can lead to an XML External Entity XXE...
EUVD-2026-47579
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling...
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a...
CVE-2026-56817
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...
DEBIAN-CVE-2026-56817
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...
PT-2026-63257
Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final Description An issue exists where a caller delivering bytes to a channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to...
📄 Oracle WebLogic WLS-WSAT XMLDecoder Remote Code Execution
This script is a Python-based proof of concept exploit targeting a deserialization vulnerability in Oracle WebLogic Server's WLS-WSAT component. The vulnerability allows unauthenticated attackers to execute arbitrary system commands via crafted SOAP requests sent to the...
Exploit for Deserialization of Untrusted Data in Vmware Spring_Framework
Reporte de Vulnerabilidad - Java Store Application Resumen...
EUVD-2022-3272
Malicious code in bioql PyPI...
Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML...
GHSA-92J2-5R7P-6HJW Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML
The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML...
Oracle Warns of Critical Remotely Exploitable Weblogic Server Flaws
Oracle on Tuesday released its quarterly Critical Patch Update for July 2021 with 342 fixes spanning across multiple products, some of which could be exploited by a remote attacker to take control of an affected system. Chief among them is CVE-2019-2729, a critical deserialization vulnerability v...