l4s-vulnapp

Уязвимое приложение Log4Shell l4s-vulnapp Это потенциально уязвимое Java-веб-приложение, содержащее Log4j2.14.1, подверженное уязвимости log4shellCVE-2021-44228. Проверенная среда и различные версии AdoptOpenJDK 17.0.10+7 Gradle 8.6 Gretty 4.1.2 Apache Tomcat 10.1.15 Apache Log4j Core 2.14.1...

log4shell-homework9

과제 9 – Log4Shell 취약점으로부터 시스템 보호 개요 이 프로젝트는 Dockerized Java 웹 애플리케이션을 취약한 Log4j 2.14.1과 함께 사용하여 Log4Shell 취약점CVE-2021-44228의 공격 및 완화를 보여줍니다. 또한 시뮬레이션된 악성 LDAP 서버를 포함하여 JNDI 인젝션 공격 경로를 설명합니다. 공격 후, Log4j 업그레이드, 입력 검증, MITRE D3FEND 및 ATT&CK 권장 사항 적용을 통해 시스템을 강화합니다. 폴더 구조 root@kitploit:...

web-inf-path-trav

WebXMLExp.py Java Webアプリケーションにおけるパストラバーサル脆弱性の悪用を支援するツールです。 このツールは、Invicti Securityのホワイトペーパー Java Webアプリケーションにおけるパストラバーサル脆弱性の悪用 で紹介されています。 インストール このツールにはPython3が必要です。 次のコマンドを実行してください: root@kitploit: pip install -r requirements.txt 使用方法: インストール後、以下のようにエクスプロイトURLを指定してください: root@kitploit: usage: pyth...

apache-struts-cve-2017-9805

The Apache Struts Webフレームワーク Apache Struts Webフレームワークは、Java Webアプリケーションを作成するための無料のオープンソースソリューションです。 Webアプリケーションは、動的な応答を生成できるという点で従来のWebサイトとは異なります。多くのWebサイトは静的なページしか配信しません。Webアプリケーションは、データベースやビジネスロジックエンジンと連携して、応答をカスタマイズできます。 JavaServer...

Tiny Java Web Server - Cross-Site Scripting

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. id: CVE-2021-37573 info: name: Tiny Java Web Server - Cross-Site Scripting author:...

DeliberatelyVulnerableWebApp

의도적으로 취약한 웹 애플리케이션 Struts 2 이 프로젝트는 Struts 2 프레임워크를 사용하는 Java 웹 애플리케이션입니다. Maven으로 빌드되었으며 Jetty 서버를 사용하여 실행할 수 있습니다. 사전 요구 사항 Java Development Kit JDK 8 이상 Apache Maven 3.6.0 이상 시작하기 프로젝트 빌드 root@kitploit: mvn clean install Jetty로 프로젝트 실행 root@kitploit: mvn jetty:run 애플리케이션 접속 웹 브라우저를 열고...

log4j2-web-vulnerable

log4j2-web-vulnerable log4j2 RCECVE-2021-44228 취약점 테스트를 위한 간단한 취약 웹 애플리케이션입니다. 시작하기 java -jar target/gs-handling-form-submission-0.1.0.jar 실행 후 http://127.0.0.1/greeting 에 접속하세요. 직접 컴파일하려면 jdk 버전 8u20 미만을 사용하세요...

undertow-io__undertow_CVE-2014-7816_1-0-16-Final

Undertow Undertow は、ノンブロッキング IO をベースとした Java Web サーバーです。いくつかの異なる部分から構成されています: ブロッキング IO とノンブロッキング IO の両方をサポートするコア HTTP サーバー Servlet 3.1 実装 JSR-356 準拠の WebSocket 実装 Webサイト: http://undertow.io 課題: https://issues.jboss.org/browse/UNDERTOW プロジェクトリーダー: Stuart Douglas [email protected] メーリングリスト:...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Libraries. The supported versions affected include Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1, and 22.0.0.2. This easily...

CVE-2026-70906

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

BIT-JAVA-2026-47034

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

BIT-JAVA-2026-47030

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

EUVD-2026-46888

Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE...

PT-2026-62195

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u491 openjfx versions prior to 17.0.20.0-1.1 Description A flaw in the JavaFX component allows an unauthenticated attacker with network access to compromise the system. Exploitation requires human interaction and affect...

CVE-2026-10845

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications...

CVE-2026-10845 IBM WebSphere Application Server is affected by an authentication bypass vulnerability

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications...

CVE-2026-40128

SAP NetWeaver Application Server Java Web Container allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or...

CVE-2026-40128 Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

SAP NetWeaver Application Server Java Web Container allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution vulnerability (CVE-2026-9319)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution vulnerability when using JAX-WS endpoints with WS-Security. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...