CVE-2021-27850_POC

CVE-2021-27850 익스플로잇 개요 CVE-2021-27850은 최신 버전의 Apache Tapestry에서 발견된 중요한 인증되지 않은 원격 코드 실행 취약점으로, AppModule.class 파일을 다운로드하여 Apache Tapestry에서 모든 직렬화된 객체를 서명하는 데 사용되는 HMAC 비밀 키를 유출할 수 있습니다. 우리는 실제 평가에서 이 CVE를 발견했으며, 제가 알기로는 Tapestry가 직렬화된 객체를 서명하는 방법에 대한 공개 익스플로잇이 없었기 때문에 Apache Tapestry 소스 코드를 오랫...

CVE-2021-27850_POC

CVE-2021-27850 익스플로잇 개요 CVE-2021-27850은 Apache Tapestry의 모든 최신 버전에서 발견된 중요한 인증되지 않은 원격 코드 실행 취약점입니다. AppModule.class 파일을 다운로드함으로써 Apache Tapestry에서 모든 직렬화된 객체에 서명하는 데 사용되는 HMAC 비밀 키를 유출할 수 있습니다. 우리는 실제 평가에서 이 CVE를 발견했습니다. 제가 아는 한 Tapestry가 직렬화된 객체에 서명하는 방법에 대한 공개적인 익스플로잇이 없었기 때문에, 오랜 시간 Apache...

CVE-2026-61899

A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources. Mitigation Mitigation for this issue is either not available...

Exploit for CVE-2026-81578

Professional security research tool for PaperCut NG/MF vulne...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

Incorrect Authorization

Overview org.apache.tapestry:tapestry-core is a Tapestry Core package for Apache Tapestry. Affected versions of this package are vulnerable to Incorrect Authorization via specially crafted URLs in the tapestry-core. An attacker can access sensitive files from the classpath by manipulating the URL...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-55243

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899

A vulnerability exists in the tapestry-core component of Apache Tapestry (version 5.5.0+ on all platforms). An attacker can exploit Incorrect Authorization by manipulating URLs to download sensitive classpath assets , which may lead to unauthorized access to internal application resources. Users ...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2021-27850

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was...

CVE-2022-31781

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service ReDoS in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on...

EUVD-2022-3496

Malicious code in bioql PyPI...

EUVD-2022-6199

Malicious code in bioql PyPI...

EUVD-2022-1222

Malicious code in bioql PyPI...

EUVD-2022-1426

Malicious code in bioql PyPI...

CVE-2021-30638

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to...