CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

EUVD-2026-65395

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

CVE-2026-55976

Apache Hive before 4.2.1 is vulnerable to a Server-Side Request Forgery (SSRF) in its Avro SerDe schema resolution component. The root cause is insufficient input validation on the avro.schema.url table property: an authenticated attacker with CREATE TABLE privilege and network access to HiveServ...

CVE-2026-55976 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

CVE-2026-53561

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

EUVD-2026-65394

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

CVE-2026-53561 Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

mac0352-ep4

mac0352-ep4 Sicherheitslückenstudie zu Apache HTTP Server 2.4.23 CVE-2016-8740...

EUVD-2026-65391

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-49050 Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-49050

Apache DolphinScheduler versions prior to 3.4.2 are affected by a privilege escalation vulnerability where a general user can mint admin access tokens by interacting with the /access-tokens endpoint. This grants a low-privileged user full administrative control, resulting in high impact on confid...

Apache-RocketMQ-RCE-CVE-2023-37582-poc

Dieses Repository hat keine README-Datei...

httpd-2.4.49

httpd-2.4.49 critico: Path Traversal ed esecuzione remota di codice in Apache HTTP Server 2.4.49 e 2.4.50 fix incompleto di CVE-2021-41773 CVE-2021-42013...

CVE-2017-5638-PoC

CVE-2017-5638 Apache Struts 2 RCE - Prova di Concetto Questo repository contiene uno script Prova di Concetto PoC che dimostra la vulnerabilità di Remote Code Execution RCE identificata come CVE-2017-5638 in Apache Struts 2. Dettagli della Vulnerabilità ID CVE: CVE-2017-5638 Software Interessato:...

Computer-Security-Equifax-2017

Dépôt éducatif démontrant des vulnérabilités logicielles réelles : RCE Apache Struts2 CVE-2017-5638, exfiltration de données, chiffrement faible et stratégies d'atténuation assainissement, surveillance, bonnes pratiques de cryptographie. Démo équipe rouge contre équipe bleue des failles de sécuri...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 में IP प्रतिबंध बायपास और डिफ़ॉल्ट एडमिन AIP टोकन का उपयोग करके रिमोट कोड निष्पादन RCE पूर्ण वॉकथ्रू https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

Struts2Shell

Struts2Shell Un exploit e libreria per CVE-2017-5638 - il bug Apache Struts2 S2-045. Installazione root@kitploit: $ npm install -g struts2shell Installazione come libreria root@kitploit: $ npm install struts2shell Opzioni della riga di comando root@kitploit: -h, --help mostra le informazioni...

riskootext4shell

riskootext4shell text4shell script for text coomons =1.10 CVE-2022-33980 A biblioteca Apache Commons Text é uma biblioteca alternativa às funcionalidades nativas do JDK do Java. Versões anteriores à versão 1.10.0 do Apache Commons Similar ao CVE-2022-33980 root@kitploit: python3 text4shell.py -u...

Detection-struts-cve-2017-5638-detector

🚨 Echtzeit-Anomalieerkennung für Apache Struts CVE-2017-5638 Zero-Day-Exploit-Erkennung basierend auf Streaming-Analytik & probabilistischen Datenstrukturen 📌 Projektbeschreibung Dieses Projekt ist ein Echtzeit-Anomalieerkennungssystem , das entwickelt wurde, um RCE-Exploits Remote Code Execution...