zwjjustdoit

3 exploits Active since Aug 2021
CVE-2021-39141 NOMISEC HIGH WORKING POC
XStream < 1.4.18 - Remote Code Execution via Deserialization
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
62 stars
CVSS 8.5
CVE-2021-34371 NOMISEC CRITICAL WORKING POC
Neo4j < 3.4.18 and 3.5.0 - Remote Code Execution via RMI Deserialization
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.
32 stars
CVSS 9.8
CVE-2022-23131 NOMISEC CRITICAL WORKING POC
Zabbix 5.4.0-5.4.7 - Unauthenticated Authentication Bypass via SAML Session Spoofing
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
1 stars
CVSS 9.1