Skip to main content
We’ve updated our Terms of Service. A new AI Addendum clarifies how Stack Overflow utilizes AI interactions.
Information Security

Questions tagged [java]

Ask Question

Security aspects specific to the Java programming language, libraries, and virtual machine.

720 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
3 votes
7 answers
3k views

I am making my first commercial Java program and am worried about crack prevention. I would run it on the cloud, except it needs to run on their machine at a runtime. I have an obfuscator set up, but ...
user31830467's user avatar
  • 63
6 votes
3 answers
1k views

I am reviewing TLS configurations in my code, there are several places where there is TLS. In these places, TLS version is hardcoded to TLSv1.2. I want to make sure that TLS 1.3 is also supported. To ...
anonymous's user avatar
  • 559
0 votes
2 answers
221 views

I'm working on a JAVA web application running on Tomcat. A session token is generated and stored in a cookie when a user authenticates. Unfortunately, when tracing is enabled, Tomcat dumps the value ...
Algiz's user avatar
  • 111
3 votes
2 answers
313 views

I'm reviewing code which apparently ignores all security standards but doesn't seem to be exploitable due to its peculiar construction. The first stage is a Java Spring application and the name ...
gquere's user avatar
  • 31
1 vote
0 answers
170 views

I'm trying to reproduce log4j vulnerability on my spring-boot java project. I know that version from 2.0 to 2.14.1 are vulnerable, i'm using the 2.14.1 version but but i'm not able to exploit it, ...
yeppa's user avatar
  • 11
0 votes
0 answers
68 views

I have a java deserialization vulnerability, with a poc. The poc exploits using the groovy library, and the groovy version is 2.4.19. When searching online for a CVE related to this gadget I couldn't ...
anonymous's user avatar
  • 559
0 votes
0 answers
134 views

I have developed a tool that can find Maven Central JAR artifacts that contain classes from known vulnerable JAR artifacts. This includes but is not limited to fat (uber) JARs, JAR bundles, and ...
Cornul11's user avatar
  • 113
1 vote
0 answers
246 views

We are integrating Google login in our app and we intend to use the idToken for authentication. We are already sending the idToken from the app to the back-end server, and intend to verify the token ...
Lucas Basquerotto's user avatar
  • 113
5 votes
2 answers
2k views

Can a non-sanitized user input result in a vulnerability if passed to System.out.printf (Or any equivalent function that takes a format)? Example: public class Demo { public static void main(...
M0ngi's user avatar
  • 163
0 votes
1 answer
242 views

I'm testing a Java application that tries to prevent ZipSlip by simply checking whether the filename contains ".." or "./" Since it's not a web application, I guess encoding is not ...
Lucius's user avatar
  • 121
1 vote
1 answer
3k views

I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one. One approach would be to extract the certificates using keytool ...
Jim's user avatar
  • 221
0 votes
2 answers
293 views

Web Server : Oracle WebLogic 10.35 Machine : Oracle Linux Server 3.8 I was able to partially exploit this CVE. I can execute any command on server using HTTP request and redirecting its output to a ...
Abu Bakar's user avatar
  • 15
0 votes
2 answers
2k views

I found vulnerable end-points in my university's old portal. It should not be accessible but I found it somehow. -> First end-point allows me to upload any kind of file on following path : /home/...
Abu Bakar's user avatar
  • 15
0 votes
1 answer
612 views

The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS? This is a language neutral question, it can be Java,...
warrior-oo7's user avatar
  • 73
1 vote
2 answers
883 views

Coverity shows the block of code as unsafe deserialization: String str = OBJECT_MAPPER.writeValueAsString(body); //Body is user controlled Ferarri myclassobj = OBJECT_MAPPER.readValue(str, Ferarri....
warrior-oo7's user avatar
  • 73
0 votes
1 answer
229 views

I need to randomly pick 10 numbers from 1 to 2000. It is very important that this rng cannot be predicted/hacked in any way. Would this be a safe/proper way to do it: int randomInt; SecureRandom ...
Cannon 190's user avatar
  • 3
1 vote
1 answer
291 views

We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...
StephenG's user avatar
  • 11
0 votes
0 answers
100 views

I need to perform a public/private key generation on USB devices and store private key parts on at least 3 USB tokens. Java javax.smartcardio allows to perform such an operation on Smart-cards that I ...
ojacomarket's user avatar
  • 111
0 votes
1 answer
243 views

Our consulting company has received a VAPT from a consulting company on behalf of a financial customer. The application has an HR/group management module. Normally employees are created by an ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
  • 5,448
1 vote
0 answers
2k views

I have to get rid of so called "weak security" in a Tomcat application. A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
MichaelW's user avatar
  • 161
1 vote
1 answer
667 views

I'm having a Spring Web Application that exposes REST APIs. I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE. The penetration testing team raised a concern where the ...
Yuval Simhon's user avatar
  • 113
1 vote
1 answer
121 views

If anyone can answer me pls I just need an anwer. I know thus isn't maybe right place for this question I created chatting app with sockets in Java 8 and i use TLS 1.2 My question is: Is there any way ...
GM dz0ji's user avatar
  • 11
1 vote
1 answer
2k views

I have an Java client program for Windows having a properties file that I need to be able to encrypt (protect it if a malicious user accesses the server and properties file) but the client program of ...
Jokkeri's user avatar
  • 113
1 vote
0 answers
677 views

I have created a ECDSA key and now need to convert this to SSH2 key. final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ECDSA"); ECGenParameterSpec params = new ...
Vicky's user avatar
  • 11
1 vote
0 answers
1k views

I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the use of the Apache Commons library commons-beanutils. The ysoserial project references commons-beanutils ...
kaidentity's user avatar
  • 2,674
0 votes
0 answers
681 views

When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused. Let's take as an example this CVE: CVE-2022-22978 In the description: "In Spring Security ...
ethicalhacker's user avatar
  • 105
0 votes
2 answers
1k views

In a recent pentest (Java thick client), it was discovered by the pentesters that TLS version 1.3 is not supported. I'm investigating why it is not supported, so I was looking in the Java code for ...
ethicalhacker's user avatar
  • 105
2 votes
1 answer
190 views

If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
ethicalhacker's user avatar
  • 105
2 votes
2 answers
875 views

My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM. Does standard java (Oracle) support CCM cipher suites? I am seeing oracle links mentioning CCM but am not able to make it work....
Amal Jesudas's user avatar
  • 61
-1 votes
1 answer
479 views

I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
ciis0's user avatar
  • 101
1 vote
2 answers
983 views

If I am already using xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); then do I also need to use xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities",...
Rupesh Pal's user avatar
  • 11
3 votes
0 answers
2k views

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
Soraru5656's user avatar
  • 41
17 votes
2 answers
3k views

When you are working with secret keys, if your code branches unequally it could reveal bits of the secret keys via side channels. So for some algorithms it should branch uniformly independently of the ...
Poperton's user avatar
  • 317
0 votes
1 answer
517 views

My Java 11 application is being upgraded to fix the log4shell flaw. So first Spring Boot has been upgraded to the latest version. As my project uses Maven to manage its dependencies, I set the log4j ...
HelloWorld's user avatar
  • 101
0 votes
1 answer
320 views

How do different secret-key algorithms generate the same data? In the snippet below, I use PBEWithMD5AndDES to produce one key, and PBEWithHmacSHA256AndAES_256 to produce another key, but with the ...
keian's user avatar
  • 103
1 vote
0 answers
259 views

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
Sangamesh T's user avatar
  • 11
0 votes
1 answer
761 views

I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
AnaphylacticInternet's user avatar
  • 3
0 votes
1 answer
3k views

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
ssl_noob's user avatar
  • 1
1 vote
1 answer
542 views

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
HunterTheox24's user avatar
  • 11
0 votes
0 answers
93 views

If a vendor provides you with a program written for Java 8, is there any security advantage of running that program in the latest OpenJDK build of Java 11 instead of the latest OpenJDK build of Java 8?...
Shawn Eary's user avatar
  • 113
33 votes
3 answers
21k views

According to the notes for CVE-2021-44228 at mitre.org: Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "...
Appleoddity's user avatar
  • 493
3 votes
1 answer
1k views

Is it enough to upgrade log4j-core and log4j-api to 2.15.0 but leave log4j-slf4j-impl, which is a binding library, to 2.14.1, given that mvn dependency:tree suggests that log4j-slf4j-impl:2.14.1 is ...
53c's user avatar
  • 133
4 votes
1 answer
503 views

Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string? For example, if the code contains: paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
Lefteris E's user avatar
  • 143
0 votes
1 answer
8k views

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
Artem Fedin's user avatar
  • 3
2 votes
0 answers
826 views

Java supports AIA chasing via the system property com.sun.security.enableAIAcaIssuers (which is disabled per default). There is some documentation available but it is pretty slim regarding details. I ...
mss's user avatar
  • 131
0 votes
1 answer
367 views

The big picture is: an android application which authenticate user with an external openid provider (such as azure AD) a Java EE server which expose rest endpoints securized with the validation of ...
Francesco Clementi's user avatar
  • 101
1 vote
1 answer
315 views

I would like to use the method described in https://connect2id.com/products/nimbus-jose-jwt/examples/jwk-generation to generate a key pair in a java application: import java.util.*; import com....
Marco Altieri's user avatar
  • 655
0 votes
0 answers
136 views

I am new to SSL/TLS, and need some help with understanding. I am running a java application, which is able to consume HTTP and HTTPS URLs as a client from the internet via httpClient. For that, I don'...
Galadriel's user avatar
  • 1
2 votes
3 answers
704 views

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
LGDGODV's user avatar
  • 193
0 votes
1 answer
280 views

Would it be possible to write a file to a directory outside of the uploads folder if the $ext variable is used controlled and unrestricted? The uploads directory is empty except for the freshly ...
Fred's user avatar
  • 1

1
2 3 4 5
…
15