CVE-2025-55668

CVE-2025-55668 Apache Tomcat - Fixação de sessão via rewrite valve...

CVE-2023-25690_lab

HTTP-Request-Smuggling über Apache-Proxy Umgebungskonfiguration Infrastruktur...

struts-rce

:source-highlighter: pygments = Apache Struts CVE-2017-5638 Ausnutzung Diese einfache Webanwendung wird mit der anfälligen Apache Struts 2.5.10 CVE-2017-5638 erstellt. Sie ist anfällig für RCE. == Starten der Webanwendung Um die anfällige Webanwendung zu starten, führen Sie aus: mvn jetty:run Die...

CVE-2021-41773-POC

CVE-2021-41773 Rapporto di riproduzione della vulnerabilità Panoramica della vulnerabilità CVE ID : CVE-2021-41773 Nome vulnerabilità : Vulnerabilità di path traversal in Apache HTTP Server Livello di rischio : Alto CVSS 7.5 Versioni interessate : Apache HTTP Server 2.4.49 Descrizione vulnerabili...

apache-cve-poc

apache-cve-poc Dockerisierter Proof-of-Concept von CVE-2021-40438 in Apache 2.4.48...

how-to-check-patch-secure-log4j-CVE-2021-44228

Come-verificare-log4j-CVE-2021-44228 Cos'è log4j ? LOG4J è un software Apache open-source basato su Java utilizzato per i servizi di logging. Cos'è la vulnerabilità log4j CVE-2021-44228 ? La vulnerabilità Log4j consente l'esecuzione remota di codice semplicemente digitando una specifica stringa i...

CVE-2017-12615-PoC

CVE 2017-12615 Apache Tomcat Windows RCE ⚠️Warnung Dies ist eine Proof-of-Concept-Umgebung und ein Exploit für bekannte CVEs, ausschließlich zu Lern- und Bildungszwecken. Verwenden Sie diese Skripte oder Techniken nicht auf Systemen, die Ihnen nicht gehören oder für die Sie keine ausdrückliche...

Apache-GOExploiter

🛠 ApacheGoExploiter – Toolkit di Exploit per il Metodo PUT CVE-2025-24813 ApacheGoExploiter è uno strumento proof-of-concept basato su Go per scansionare e sfruttare server Apache Tomcat vulnerabili a CVE-2025-24813. Verifica il supporto HTTP PUT esposto sulla porta 8080 e tenta di caricare file ...

Common-Vulnerability-and-Exploit

Common-Vulnerability-and-Exploit-5638 Questa è la vulnerabilità Apache Struts CVE-2017-5638 di struts 2. La stessa CVE che ha portato alla violazione del database di equifax. Un articolo su come applicare questo exploit e come difendersi tramite patch...

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...

Apache OFBiz 17.12.03 - Cross-Site Scripting

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. id: CVE-2020-9496 info: name: Apache OFBiz 17.12.03 - Cross-Site Scripting author: dwisiswant0 severity: medium description: Apache OFBiz 17.12.03 contains cross-site scripting a...

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

Apache Struts <=2.5.20 - Remote Code Execution

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation when evaluated on raw user input in tag attributes, which may lead to remote code execution. id: CVE-2019-0230 info: name: Apache Struts =2.5.20 - Remote Code Execution author: geeknik severity: critical description: Apache Struts 2.0.0 ...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

Apache Struts2 S2-062 - Remote Code Execution

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...

Apache Tapestry - Remote Code Execution

Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

Ivanti Sentry - Authentication Bypass

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. id: CVE-2023-38035 info: name: Ivanti...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...