CVE-2013-2186

Version based search for vulnerabilities in Jar files, using victims-cve-db database.

Victims CVE Database Version Search This script allows searching for vulnerabilities associated with specific versions of Java archives (jar files) using database provided by victims-cve-db For each jar file the version information is retrieved: Using Maven manifest (pomxml), if it does exist within jar Using version included into filename and filename as artifactId Using

Vul4J: A Dataset of Reproducible Java Vulnerabilities

Introduction Vul4J is a dataset of real-world Java vulnerabilities Each vulnerability in the dataset is provided along with a human patch, Proof-of-Vulnerability (PoV) test case(s), and other information for the reproduction of the vulnerability In this repository, we host the Vul4J dataset, the support framework that allows performing several common tasks required by APR too

Payload generator for Java Binary Deserialization attack with Commons FileUpload (CVE-2013-2186)

ACEDcup ACEDcup tool is a payload generator for Java Binary Deserialization attack (ACED) For Apache Commons FileUpload ver <= 13 (CVE-2013-2186) and Oracle JDK ver < 7u40 The attack works even for newer versions of the lib or Java We can upload any content in any directory, but we cannot control a file name (smth like upload_f71d3547_72ed_4ae1_90fe_0d319115cd42

Source code for CVE-2013-2186

CVE_2013_2186 Source code for CVE-2013-2186

Code generate payload for CVE-2013-2186

Payload_CVE_2013_2186 Code generate payload for CVE-2013-2186

Vul4J: A Dataset of Reproducible Java Vulnerabilities

Introduction Vul4J is a dataset of real-world Java vulnerabilities Each vulnerability in the dataset is provided along with a human patch, Proof-of-Vulnerability (PoV) test case(s), and other information for the reproduction of the vulnerability In this repository, we host the Vul4J dataset, the support framework that allows performing several common tasks required by APR too