CVE-2025-24813

Condiciones de explotación Función de escritura de DefaultServlet habilitada: es necesario configurar readonly=false en web.xml Soporte de solicitudes PUT parciales: Tomcat admite la carga por fragmentos de forma predeterminada Persistencia de sesiones de archivo habilitada: es necesario configur...

CVE-2025-24813

Descripción Este repositorio es un entorno de reproducción para la última RCE de Tomcat CVE-2025-24813. ¡Solo para fines de aprendizaje e investigación! Condiciones de explotación La aplicación tiene habilitada la función de escritura de DefaultServlet, que está desactivada por defecto La...

CVE-2025-24813-POC

CVE-2025-24813: Apache Tomcat RCE Proof of Concept This repository provides a controlled, automated environment to demonstrate Remote Code Execution RCE vulnerabilities in Apache Tomcat via CVE-2025-24813. Overview This PoC exploits misconfigured file-based session persistence in Apache Tomcat's...

POC-CVE-2025-24813

CVE-2025-24813 – Ambiente de Demostración PoC Este repositorio contiene una aplicación simple construida para observar el comportamiento del CVE-2025-24813, una vulnerabilidad reciente en Apache Tomcat relacionada con el uso del DefaultServlet con escritura habilitada readonly=false, permitiendo...

CVE-2017-12615

CVE-2017-12615 - Ejecución remota de código RCE en Apache Tomcat CVE-2017-12615 es una vulnerabilidad de ejecución remota de código RCE que afecta a Apache Tomcat 7.0.0 hasta 7.0.79 que se ejecuta en Microsoft Windows cuando las solicitudes HTTP PUT están habilitadas. La vulnerabilidad existe...

Spring-Boot-Tomcat-CVE-2025-24813

CVE-2025-24813: Apache 1. Explanation Tomcat is vulnerable because of two separate vulnerabilities, the first is a weakness in the DefaultServlet which allows partial puts to write a temp directory see:...

CVE-2017-12615-Home-Lab

CVE-2017-12615 Tomcat: Ejecución Remota de Código mediante Subida de JSP Este laboratorio simula la vulnerabilidad CVE-2017-12615 Tomcat: Ejecución Remota de Código mediante Subida de JSP Se produce por la configuración readonly=false, que permite subir archivos mediante HTTP PUT , incluyendo...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

利用条件 + DefaultServlet 写入功能启用：需在 web.xml 中配置 readonly=false...

Apache Tomcat Remote Code Execution Vulnerability

Apache Tomcat is an open source lightweight Java Web server and Servlet container , designed to run Java Servlet and JSP core tools designed to support dynamic content processing and hosting of static resources , is the cornerstone of small and medium-sized Java Web application development and...

Apache Tomcat 环境问题漏洞

Apache Tomcat is an open source lightweight Java Web server and Servlet container , designed to run Java Servlet and JSP core tools designed to support dynamic content processing and hosting of static resources , is the cornerstone of small and medium-sized Java Web application development and...

The vulnerability of the DefaultServlet server servlet in the Apache Tomcat application server allows a attacker to execute arbitrary code.

The vulnerability of the DefaultServlet server component in the Apache Tomcat application server is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SUSE-SU-2024:4106-1 Security update for tomcat

This update for tomcat fixes the following issues: - Update to Tomcat 9.0.97 Fixed CVEs: + CVE-2024-52316: If the Jakarta Authentication fails with an exception, set a 500 status bsc1233434 Catalina + Add: Add support for the new Servlet API method HttpServletResponse.sendEarlyHints. markt + Add:...

SUSE-SU-2024:4105-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: - Update to Tomcat 10.1.33 Fixed CVEs: + CVE-2024-52316: If the Jakarta Authentication fails with an exception, set a 500 status bsc1233434 Catalina + Add: Add support for the new Servlet API method HttpServletResponse.sendEarlyHints. markt +...

SUSE CVE-2018-12536

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

K01869532: Eclipse Jetty vulnerability CVE-2019-10241

Security Advisory Description In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of...

DOS vulnerability for Quoted Quality CSV headers

Impact When Jetty handles a request containing request headers with a large number of “quality” i.e. q parameters such as what are seen on the Accept, Accept-Encoding, and Accept-Language request headers, the server may enter a denial of service DoS state due to high CPU usage while sorting the...

CVE-2017-5664

A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. Mitigation If it is necessary to have the DefaultServlet propert...

jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents...

jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents...

The vulnerability of the DefaultServlet component of the Jetty HTTP server allows a attacker to gain unauthorized access to protected information.

The vulnerability of the DefaultServlet component in the Jetty HTTP server is related to errors in error handling when incorrect requests are used. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information by displaying the InvalidPathException message,...