Exploiting Java Deserialization

Deserialization of untrusted data | OWASP Foundation

What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.foxglovesec