Demystifying Insecure Deserialisation on JSF Application [ASCIS 2020 Final Writeup] mojarra_war — JSF ViewState deserialize