struts-pwn

struts-pwn An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Checking if the vulnerability exists against a single URL...

CVE-2021-37580

Apache ShenYu Admin has an authentication bypass vulnerability that allows attackers to bypass JSON Web Token JWT security authentication and directly access the system backend. Apache ShenYu is an extensible, high-performance, and reactive API gateway solution used in all microservice scenarios...

st2-048

St2-048 Remote Code Execution Vulnerability Apache Struts 2 possible RCE in the Struts Showcase app in the Struts 1 plugin example in the Struts 2.3.x series http://struts.apache.org/docs/s2-048.html https://cwiki.apache.org/confluence/display/WW/S2-048 Use-Age: python St2-048.py set url :...

CVE-2022-42889

CVE-2022-42889 Test application This repository contains a simple application using Apache Commons Text 1.10 which is vulnerable to CVE-2022-42889. Running the application Replace DemoApplication.java nc command by your host ip address. Listening with netcat: $ nc -l -p 30000 Build and run docker...

kafka-keycloak-oauth

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Production-ready Apache Kafka 4.1.0 KRaft mode with Keycloak 26.1.1 OAuth2/OIDC authentication using Strimzi Kafka image. Why This Project vs kafka-oauth-keycloak-tls-demo This is an evolution of the previous POC with significant improvements...

CVE-2024-36104

CVE-2024-36104 Disclaimer This tool is only for personal security research and learning. Any direct or indirect consequences and losses caused by the dissemination or use of this tool are solely the responsibility of the user. The tool author does not assume any responsibility. version = 18.12.14...

spark-python-ds-static

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-python-ds-static spark-python-ds-static Class: Privilege leftover Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation DataSourceManager.dataSourceBuilders is a JVM-global first-wins map...

CVE-2021-41773

CVE-2021-41773 A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013 References https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-41773 https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-42013...

-CVE-2021-44790

CVE-2021-44790 Description of CVE-2021-44790 CVE-2021-44790 describes a system-level security vulnerability in the modlua of the Apache HTTP Server, specifically in version 2.4.51 and earlier versions. This vulnerability is triggered when the r:parsebody function improperly handles HTTP...

garak

garak, LLM vulnerability scanner Generative AI Red-teaming & Assessment Kit garak checks if an LLM-backed application can be made to fail in a way we don't want. garak probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and many other...

ActiveMQ_CVE-2015-5254

ActiveMQ Deserialization CVE-2015-5254 Vulnerability Description: Security vulnerabilities exist in Apache ActiveMQ versions before 5.13.0. The issue stems from the program not restricting the classes that can be serialized in the broker. Remote attackers can exploit this by sending a specially...

CVE-2024-32113

CVE-2024-32113 Apache OFBIZ Batch Scanning 注意：このツールを違法攻撃に使用することを支援するものではありません。このツールは技術的な交流のみを目的としています。 Note: This tool does not support any illegal attacks. It is intended solely for technical exchange. 注意：本人不支持任何人使用本工具进行非法攻击，本工具仅作为技术交流。 Help CVE-2024-32113 Batch Scanning optional arguments: -h,...

s2-067-CVE-2024-53677

s2-067-CVE-2024-53677 s2-067CVE-2024-53677 Summary File upload logic is flawed, and allows an attacker to enable paths with traversals - similar problem as reported in S2-066 Who should read this All Struts 2 developers and users Impact of vulnerability Remote Code Execution Maximum security rati...

CVE-2026-32794

CVE-2026-32794: TLS Certificate Verification Bypass in Apache Airflow Databricks Provider Keywords: TLS, certificate verification, MITM, Kubernetes, Databricks, OAuth, CWE-295, Apache Airflow Table of Contents Overview Vulnerability Details Technical Analysis Attack Chain Impact Remediation...

CVE-2019-17571

CVE-2019-17571 / Apache Log4j 1.2.X Deserialization Remote Code Execution Vulnerability Vulnerability warning reference link: https://mp.weixin.qq.com/s/okU2y0izfnKXXtXG3EfLkQ 1. Vulnerability Description Apache Log4j is a Java-based open-source logging tool developed by the Apache Software...

CVE-2025-27636-demo

Apache Camel CVE Demonstration This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks. Docker Build Build the Docker image: docker build -t camel-cve-demo . Docker Run Run the container with all necessary ports: docker run -d --name camel-cve-demo -...

apache-flink-directory-traversal.nse

This repository does not have a README...

CVE-2021-41773

ApacheRCE ApacheRCE is a small little python script that will allow you to input the apache version 2.4.49-2.4.50 and then input a list of ip addresses from a text file and mass run the exploit on them, this can be useful if you are running mutiple websites and you want to see if they can all be...

CVE-2024-24549

Here’s a README.md for a Proof of Concept PoC demonstrating the Denial of Service DoS vulnerability in Apache Tomcat due to improper input validation of HTTP/2 requests: Proof of Concept PoC for Denial of Service DoS Vulnerability in Apache Tomcat This repository contains a Proof of Concept PoC...

scarce-apache2

ScaRCE Framework - CVE-2021-41773 Hunter This tool can scan websites with CVE-2021-41773 Vulnerability that are affecting Apache2 Webserver, ScaRCE can run too for executing Remote Command Injections at the webservers that found from the scanning method Only if the MODCGI is Enabled at the target...