CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat PUT Parcial + Deserialización RCE 📋 Resumen CVE-2025-24813 es una vulnerabilidad de alta gravedad en Apache Tomcat que permite ejecución remota de código no autenticada cuando se cumplen tres condiciones: 1. El servlet predeterminado tiene habilitado el acceso de...

CVE-2025-24813

Description This repository is an environment for reproducing the latest RCE of CVE-2025-24813 Tomcat. For learning and research purposes only! Exploitation Conditions The application has enabled the DefaultServlet write functionality, which is disabled by default. The application supports partia...

CVE-2025-62343

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2025-62343 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2025-62343

HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability that may allow user sessions to remain active after logout or session deletion. The assigned CVSS 3.1 score is 3.1 (LOW) , reflecting a network attack vector with high complexity and required user inte...

CVE-2025-24813

शोषण की शर्तें DefaultServlet लेखन कार्यक्षमता सक्षम करें: web.xml में readonly=false कॉन्फ़िगर करना आवश्यक है Partial PUT अनुरोध समर्थन: Tomcat डिफ़ॉल्ट रूप से चंक्ड अपलोड का समर्थन करता है फ़ाइल सत्र दृढ़ता सक्षम करें: context.xml में PersistentManager और FileStore कॉन्फ़िगर करना आवश्यक है...

BreakEscape

BreakEscape Rails Engine Cybersecurity-Schulungs-Escape-Room-Spiel als einbindbare Rails Engine. Funktionen 24+ Cybersecurity-Escape-Room-Szenarien Serverseitige Fortschrittsverfolgung mit 2-Tabellen-Schema Zufällige Passwörter pro Spielinstanz via ERB JIT-Ink-Skriptkompilierung für NPC-Dialoge...

burp_global_match_replace

Global Match & Replace GMR Estensione Burp Suite Global Match & Replace GMR estende Burp Suite con regole di match/replace da applicare globalmente o su più strumenti a scelta Repeater, Intruder, Proxy, ecc.. Fornisce diff per richiesta e risposta così puoi vedere esattamente cosa è cambiato...

Tomcat-CVE-2025-24813

Condizioni d'Uso La funzione di scrittura di DefaultServlet è abilitata: è necessario che in web.xml sia configurato inreadonly=false Supporto delle richieste PUT parziali: Tomcat supporta l'upload a blocchi per impostazione predefinita Persistenza delle sessioni su file attivata: è necessario...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Persistenza della sessione dopo l'attivazione del 2FA Panoramica L'applicazione Nagios Fusion versioni 2024R1.2 e 2024R2 presenta un grave difetto di sicurezza per cui le sessioni esistenti rimangono valide anche dopo l'attivazione dell'autenticazione a due fattori 2FA. In particolare, quando il...

CVE-2026-34828

CVE-2026-34828 Persistenza delle sessioni di listmonk dopo il reset e la modifica della password Introduzione Ho trovato questo problema mentre esaminavo listmonk , un gestore open-source di newsletter e mailing list, con una semplice domanda di sicurezza in mente: Quando un utente modifica o...

java-vulnerable

Demo consumer per CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi information disclosure più quattro vulnerabilità Java OSS filter-padding. context.xml abilita PersistentManager → catena Tomcat HOT; applicationContext-security.xml protegge /api/rpc/users/ verso...

Burp-Recordadora

🧙‍♂️ Recordadora Recordadora è un'estensione per BurpSuite ispirata a Harry Potter. Come la ricordella di Neville, ti aiuta a non dimenticare né perdere il contesto dei tuoi test. ✨ Funzionalità Salvare e ripristinare la cronologia del Proxy Esportare e importare le richieste del Repeater Rendere...

CVE-2026-66376

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-17600

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

CVE-2026-17599

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

EUVD-2026-53818

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

CVE-2026-39924

CVE-2026-39924 affects Flarum prior to 1.8.16. The vulnerability is a session persistence issue caused by not clearing the access_tokens table on password changes, leaving attacker-held sessions active even after a victim resets a password. The TokensClearer::clearPasswordTokens() function only r...