CVE-2022-22965

CVE-2022-22965 aka "Spring4Shell" JDK 9+ 上の Data Binding を介した Spring Framework の RCE 脆弱性 この脆弱性に関する現時点での公知情報を可能な限り集約し、そのような場合に取るべき対策を把握することを目的としています。 私のアプリケーションは脆弱ですか？ 満たすべき条件（AND）は以下の通りです： JDK 9 + Apache Tomcat を Servlet コンテナとして使用 WAR としてパッケージ化されたアプリケーション spring-webmvc または spring-webflux の依存関係...

Apache Tomcat - HTTP Request Smuggling

Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicio...

Apache Tomcat Examples Web Application - Cross-Site Scripting

Apache Tomcat 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 contain a reflected cross-site scripting caused by displaying unfiltered user data in the Form authentication example, letting attackers execute scripts in victim browsers, exploit requires attacke...

Apache Tomcat - Cross-Site Scripting

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, fro...

cve-2025-24813-poc

CVE-2025-24813 Apache Tomcat RCE エクスプロイト PoC このリポジトリには、Apache Tomcat の Java デシリアライゼーション脆弱性である CVE-2025-24813 用の概念実証（PoC）エクスプロイトが含まれています。 以下に基づいています: absholi7ly/POC-CVE-2025-24813/。 前提条件 Docker セットアップ 1. 依存関係をインストールします: root@kitploit: uv venv source .venv/bin/activate uv sync 2. ysoserial...

CVE-2023-4220

autopwn...

CVE-2025-24813-POC

CVE-2025-24813 概念验证（独立版） 本仓库包含针对 CVE-2025-24813 的非破坏性独立 PoC，该漏洞存在于 Apache Tomcat 9.0.55 中，允许通过部分 PUT 请求进行远程文件上传。此漏洞利用通过上传并访问一个无害的 JSP 文件来演示代码执行。 📁 目录 proof.jsp：用于演示代码执行的无害 JSP 载荷。 cve202524813clientdemo.py：用于检测、利用、验证、记录和清理的 Python3 脚本。 report.txt：自动生成的测试会话日志。 🧰 环境要求 Python 3.7+ 可选：html2image...

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation

A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of reques...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

org.apache.tomcat/tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2025-55752

CVE-2025-55752：Apache Tomcat 路径遍历漏洞 基于 Docker 的 CVE-2025-55752 复现环境，该漏洞是 Apache Tomcat 10.1.44 中的一个路径遍历漏洞。 概述 CVE-2025-55752 是 Apache Tomcat RewriteValve 中的一个路径遍历漏洞，由错误的处理顺序引起：URL 规范化发生在 URL 解码之前 。这允许攻击者使用 URL 编码的路径遍历序列（..%2f）绕过对 /WEB-INF/ 等目录的安全限制。 漏洞特征 CVE ID ：CVE-2025-55752 CVSS v3.1 ：7.5（高危）...

cve-2026-29145

CVE-2026-29145 — OCSPチェックがソフトフェイル無効時でもソフトフェイルすることがある 発見者: gregk4sec https://github.com/gregk4sec/cve 発見日: 2026-02-26 影響を受けるベンダー: Apache 影響を受ける製品: Tomcat 深刻度: 9.1 CRITICAL CWE: CWE-287 不適切な認証 ステータス: 審査中 / 修正済み / 非公開 / 公開 ✅ 概要 CLIENTCERT認証は、ソフトフェイルが無効になっている一部のシナリオで、期待どおりにOCSPチェックを失敗させませんでした。 技術分析 参...

cve-2026-25854

CVE-2026-25854 — 偶発的なオープンリダイレクト 発見者: gregk4sec https://github.com/gregk4sec/cve 発見日: 2026-01-30 影響を受けるベンダー: Apache 影響を受ける製品: Tomcat 11.0.x / 10.1.x / 9.x 深刻度: 6.1 Medium CWE: CWE-601 信頼されないサイトへのURLリダイレクト（'オープンリダイレクト'） ステータス: 審査中 / 修正済み / 非公開 / 公開 ✅ 概要 LoadBalancerDrainingValve を使用するクラスタ内の Tomcat...

vuln4japi

vuln4japi 一个存在漏洞的基于 Java 的 REST API，用于演示 CVE-2021-44228（log4shell）。 动机 Log4Shell 在 2021 年 12 月初席卷了整个互联网。Apache Log4j 日志库中的一个零日漏洞能够实现远程代码执行（RCE），导致全球各地的组织争相修复、打补丁和缓解其面向公众的 Java 应用程序。随着信息安全社区团结起来，为安全团队提供持续的分析和解决方案，Log4j 社区也在忙着开发补丁，以确保这一漏洞的终结。 我开发了这个简单的存在漏洞的 REST API，通过利用 Apache Tomcat...