115 matches found
CVE-2025-24813
CVE-2025-24813 - Apache Tomcat Path Equivalence Vulnerability Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths. CVE ID: CVE-2025-24813 Severity: Critical Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg Po...
CVE-Arsenal-Lab
TomcatScanner Advanced Detection and Exploitation Tool for CVE-2025-24813 TomcatScanner is a comprehensive security tool designed for detecting and exploiting the CVE-2025-24813 vulnerability in Apache Tomcat servers. This vulnerability involves a path equivalence issue in the 'file.Name' paramet...
CVE-2026-66835
A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...
CVE-2025-24813-POC
JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...
nuclei-CVE-2025-24813
nuclei-CVE-2025-24813 Este repositorio contiene una plantilla yaml para escanear si un servicio puede ser vulnerable a CVE-2025-24813, sin interrumpir el servidor ni causar ningún tipo de daño, utilizando el escáner de vulnerabilidades nuclei. CVE-2025-24813 CVE-2025-24813 es una vulnerabilidad e...
Astra Linux – Vulnerability in Tomcat9
Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...
CVE-2026-73019
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...
EUVD-2026-73754
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-73019
CVE-2026-73019 involves an improper resolution of path equivalence in the Windows URL Moniker component, allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability requires user interaction and grants low confidentiality impact with no integrity or availabili...
Windows URL Moniker Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...
Linux Distros Unpatched Vulnerability : CVE-2026-66835
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixin...
inets: Erlang/OTP inets httpd: Directory protection bypass allows information disclosure
A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...
AZL-98463 CVE-2026-66835 affecting package erlang for versions less than 26.2.5.21-6
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
CVE-2026-66835
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
DEBIAN-CVE-2026-66835
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
CVE-2026-66835
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
UBUNTU-CVE-2026-66835
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
EUVD-2026-69245
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...