DeliberatelyVulnerableWebApp

意図的に脆弱なWebアプリケーション（Struts 2） このプロジェクトは、Struts 2フレームワークを使用したJava Webアプリケーションです。Mavenでビルドされ、Jettyサーバーを使用して実行できます。 前提条件 Java Development Kit（JDK）8以上 Apache Maven 3.6.0以上 はじめに プロジェクトのビルド root@kitploit: mvn clean install Jettyでプロジェクトを実行 root@kitploit: mvn jetty:run アプリケーションへのアクセス...

CVE-2024-31848-PoC

Jettyサーバー内のCDataの悪用 - CVE-2024-31848/49/50/51 - ファイルパストラバーサル&ファイル読み取り 概要 組み込みJettyサーバー上でCDataアプリケーションを実行しているターゲットに対する脆弱性分析を自動化するためのプロトタイプPoCです。 使用方法 ターゲットを指定するには、-uまたは--urlを使うだけです。スクリプトは、すべてのCDataインスタンスに存在するgetSettings.rsb?ファイルの取得を試みます。 例 注記 将来的に、より多くのエラーハンドリングが追加される予定です。 免責事項...

ROOT-APP-MAVEN-CVE-2026-1605 CVE-2026-1605 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2026-1605 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

ROOT-APP-MAVEN-CVE-2024-8184 CVE-2024-8184 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2024-8184 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-10051 CVE-2026-10051 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2026-10051 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

EUVD-2026-52423

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

PT-2026-67497

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.10.0 Description The application REST API supports gzip-encoded HTTP requests via a Jersey encoding filter. The framework enforces a maximum request size on the compressed payload instead of the decompresse...

Information Exposure

org.eclipse.jetty, jetty-server is vulnerable to Information Exposure. The vulnerability is due to improper handling of HTTP/1.1 request trailers, where trailers from a previous request are retained and reused across subsequent requests on the same connection, which allows an attacker to access o...

Missing Release of Memory after Effective Lifetime

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the request-body read path in HttpConnection.java. An attacker can...

Improper Validation of Consistency within Input

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verifyHttpURI, HttpFields, HttpCompliance,...

Exposure of Data Element to Wrong Session

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the connection-scoped trailers handling in the HTTP/1.1 request processing path. ...

SUSE CVE-2026-10051

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...

UBUNTU-CVE-2026-10051

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...

CVE-2026-10051

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...

CVE-2026-10051

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...