410 matches found
cve-2026-43515-poc
CVE-2026-43515 — Apache Tomcat Security Constraint Bypass Exploitability verdict: confirmed exploitable. A POST request to a resource protected by a split configuration bypasses authentication entirely. The required web.xml shape is uncommon in standard deployments — see Analysis for details. Tab...
ssrf-sheriff
SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...
API-SPY-API-PROBE
API-SPY 🕵️👻 Una potente herramienta de fuerza bruta de directorios diseñada para el reconocimiento de API y pruebas de penetración. Descubre automáticamente endpoints API ocultos, realiza subescaneos recursivos y sondea métodos HTTP para una enumeración de API más profunda. Features ✨ Capacidades...
toxy
toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...
Rejetto HTTP File Server - Template injection
This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...
Security update for distribution (important)
openSUSE security update: security update for distribution ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21898-1 Rating: important References: bsc1268884 bsc1276677 bsc1277966 bsc1278997 bsc1279219 bsc1279316 Cross-References: CVE-2026-37236...
EUVD-2026-84967
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...
CVE-2026-17635
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...
CVE-2026-17635
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to perform unauthorized actions . This issue stems from an improper configuration of HTTP method-based security constraints . The vulnerability is assigned a CRITICAL sev...
CVE-2026-17635 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...
CVE-2026-52740
GoCD (continuous delivery server) versions 18.7.0 through 26.1.0 are affected by an authorization bypass in the Get Template Config API . The root cause is a case-sensitive comparison of HTTP method names when selecting authorization filters. A lower-privileged authenticated user can send a reque...
CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...
CVE-2026-94379
CVE-2026-94379 affects MISP (versions
CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)
The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...
tomcat-coyote: tomcat: Improper Authorization allows security bypass
In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...
SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...
CVE-2025-3639
CVE-2025-3639 PoC - Bypass de Inicio de Sesión en Liferay Portal/DXP Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-3639 , una vulnerabilidad de omisión de inicio de sesión en Liferay Portal versiones 7.3.0–7.4.3.132 y Liferay DXP varias versiones desde 2024.Q1 hasta 2025.Q1.6...
tomcat-coyote: tomcat: Improper Authorization allows security bypass
In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...
tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass
A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...