Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)
Vulnerability Description
Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Vulnerability Type
可信数据的反序列化
Vulnerability Title
Ladybug debug 安全漏洞
Vulnerability Description
Ladybug debug是WeAreFrank!开源的一个调试和测试工具。 Ladybug debug 3.0-20251107.114628之前版本存在安全漏洞，该漏洞源于反序列化漏洞，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A