CVE-2020-9484

CVE-2020-9484 Kali 2.0으로 Apache Tomcat Session 역직렬화 코드 실행 취약점 CVE-2020-9484 재현 환경： 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz（webapp은 s2-053이고, 해당 lib에 commons-collections4-4.0.jar를 추가함） 시작 /yourtomcatdir/bin/startup.sh payload 생성 java -jar ysoserial-0.0.6-SNAPSHOT-all.jar...

CVE-2025-24813

CVE-2025-24813 - Apache Tomcat 원격 코드 실행 익스플로잇 이는 CVE-2025-24813 에 대한 개념 증명PoC 익스플로잇입니다. Apache Tomcat9.0.80–9.0.83, 10.1.0–10.1.17의 취약점으로, 세션 역직렬화를 통해 원격 코드 실행RCE이 가능합니다. 이 익스플로잇은 부분 PUT 요청과 PersistentManager 세션 저장 메커니즘을 악용하여 코드 실행을 달성합니다. Description Apache Tomcat은 불완전한 파일 업로드를 잘못 처리합니다. 공격자는...

CVE-2025-24813

CVE-2025-24813 익스플로잇 툴킷 이것은 CVE-2025-24813 을 위한 고급 자동화 익스플로잇 도구로, 안전하지 않은 세션 역직렬화에 취약한 Apache Tomcat 서버를 대상으로 합니다. 🔍 기능 파일 또는 단일 URL에서 다중 대상 스캔 --targets / --url 자동 가젯 체인 테스트 CommonsCollections1-7, BeanShell, Spring 등 OS 탐지 및 익스플로잇 후 페이로드 Linux/Windows 일반적인 엔드포인트에서 세션 ID 발견 콘솔 및 파일 모두에 상세 로깅 TLS...

Spring-Boot-Tomcat-CVE-2025-24813

CVE-2025-24813: Apache 1. 설명 Tomcat은 두 가지 별도의 취약점으로 인해 취약합니다. 첫 번째는 DefaultServlet의 약점으로, 부분 PUTpartial put을 통해 임시 디렉터리에 파일을 쓸 수 있습니다. 참조: https://github.com/apache/tomcat/blob/f2a274bc00cf73670a614999561c69a391b5e35f/java/org/apache/catalina/servlets/DefaultServlet.javaL608 두 번째는 FileStore 클래스로,...

CVE-2025-24813

CVE-2025-24813 Apache Tomcat - セッションのデシリアライゼーションによるリモートコード実行 認証不要の部分的なPUT + パストラバーサル + ガジェット駆動のデシリアライゼーション 説明 デフォルトのサーブレットPUTが有効（readonly=false）になっているApache Tomcatインスタンスでは、HTTP...

Apache-Tomcat---Remote-Code-Execution-via-Session-Deserialization-CVE-2025-24813-

Apache-Tomcat---원격-코드-실행-세션-역직렬화-통한-CVE-2025-24813- Apache Tomcat - 세션 역직렬화를 통한 원격 코드 실행 CVE-2025-24813...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

Exploit for CVE-2026-82222

CVE-2026-82222 Unauthenticated PHP object injection to RCE...

cve-analysis-exploitation-mitigation

CVE Analysis, Exploitation & Mitigation A hands-on cybersecur...

EUVD-2026-54568

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit para execução...

PYSEC-2026-2865 pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

CVE-2026-7818

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 Here's the updated README file, now including t...

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

Summary The fix for CVE-2026-33509 GHSA-r7mc-x6x7-cqxx added an ADMINONLYOPTIONS set to block non-admin users from modifying security-critical config options. The storagefolder option is not in this set and passes the existing path restriction because the Flask session directory is outside both...

CVE-2026-2646

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSLd2iSSLSESSION function. When deserializing session data with SESSIONCERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and...

Linux Distros Unpatched Vulnerability : CVE-2026-2646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSLd2iSSLSESSION function. When deserializing session data with SESSIONCERTS enabled, certificate a...

Heap-based Buffer Overflow

Overview wolfssl is a Python module that encapsulates wolfSSL's C SSL/TLS library. Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the wolfSSLd2iSSLSESSION function when deserializing session data with the SESSIONCERTS option enabled. An attacker can corrupt heap...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the wolfSSLd2iSSLSESSION function when deserializing session data with the SESSIONCERTS option enabled. An attacker can corrupt heap memory and potentially execute arbitrary code or cause a crash by supplyi...

DEBIAN-CVE-2026-2646

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSLd2iSSLSESSION function. When deserializing session data with SESSIONCERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and...