Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Multiple Vulnerabilities (S2-075) (S2-078)

The version of Apache Struts installed on the remote host is 2.0.0 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by multiple vulnerabilities, as referenced in the S2-075 and S2-078 advisories: - Improper neutralization of specia...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2026:1791536084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791536084 advisory. - Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

PT-2026-108866

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The STSTokenValidator and Security Token Service STS cache validated security tokens using a non-cryptographic 32-bit hash...

Apache Struts 2.5.14 <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-076)

The version of Apache Struts installed on the remote host is 2.5.14 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced in the S2-076 advisory: - Asymmetric resource consumption amplification vulnerability i...

Apache HugeGraph 1.7.0 SecurityManager Sandbox Bypass Remote Code Execution

Apache HugeGraph version 1.7.0 contains a SecurityManager sandbox bypass that allows unauthenticated remote command execution through the Gremlin endpoint. !/usr/bin/env bash Apache HugeGraph 1.7.0 Sandbox Bypass Remote Code Execution Vendor: The Apache Software Foundation Product web page:...

fastjson

fastjson Fastjson es una librería de Java que se puede usar para convertir objetos Java a su representación JSON. También se puede usar para convertir una cadena JSON en un objeto Java equivalente. Fastjson puede trabajar con objetos Java arbitrarios, incluyendo objetos preexistentes de los cuale...

ApacheRCEEssay

CVE-2021-41773 Essay 🕸️ Description 🖼️ This repository contains an essay about CVE-2021-41773, a remote code execution vulnerability in Apache 2.4.49. This was created for a course from Faculty of Automatic Control and Computers, University POLITEHNICA of Bucharest, namely "Cyberdefences and...

Detections-CVE-2026-23918

MOVING TO: https://github.com/insomnisec/publiccvedetections FOR BETTER LONG TERM MANAGEMENT OF DETECTION PUBLICATIONS THIS REPO WILL BE REMOVED IN JUNE 2026 PLEASE USE THE OTHER REPO GOING FORWARD CVE-2026-23918 "Apache HTTP/2 Double-Free" — Detection & Response Package Published: 2026-05-04...

Log4jPatch

-- This repository has been archived -- Further development of this tool will continue at corretto/hotpatch-for-apache-log4j2. Thanks for sharing, commenting, trying it out and contributing to this project! Log4jPatch This is a POC of a simple tool which injects a Java agent into a running JVM...

poc-cve-2025-69219

CVE-2025-69219 apache airflow deserializzazione non sicura verso RCE 1. copia poc.py nella directory dags di Airflow. 2. avvia il workflow poc dall'UI. 3. controlla i log delle attività per l'output dell'esecuzione...

CVE-2020-17530

CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h -c COMMAND -n...

cve-2025-24813-poc

CVE-2025-24813 Apache Tomcat RCE Exploit PoC This repository contains a proof-of-concept exploit for CVE-2025-24813, a Java deserialization vulnerability in Apache Tomcat. Based on absholi7ly/POC-CVE-2025-24813/. Prerequisites Docker Setup 1. Install dependencies: uv venv source .venv/bin/activat...

l4j-info

l4j-info Compiling valuable links as I find them documenting CVE-2021-44228 or Log4J Critical First Party advisories: Existing Log4J 1.2 vulnerability CVE-2019-17571 is also potentially present Apache Log4J Version 2.x Security Information VMWare critical vulnerability advisory Cisco product...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic ⚠️ For authorized testing / research...

ghostcatch

ghostcatch Python to disable AJP connectors in Apache Tomcat to remediate CVE-2020-1938 Ghostcat! Currently written for: Python 2.7 Requires: pip install progress Usage: python ghostCatch.py -help is the flag for usage Example: python ghostCatch.py -help -path is the flag to specify path Example:...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Rewrite rule bypass Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2025-02-28 Affected Vendor: Apache Affected Product: Tomcat 9.0.x / 10.1.x / 11.0.x Severity: Critical / High CWE: CWE-116 Status: Under Review / Fixed / Public ✅ / Private...

CVE-2022-41678

Apache ActiveMQ CVE-2022-41678 Exploit Tool Vulnerability Overview Reference document: https://app.nextcyber.cn/courses/41/tasks/580 CVE-2022-41678 is a remote code execution vulnerability in Apache ActiveMQ. This vulnerability allows an attacker to modify Log4j configuration or JFR Java Flight...

CVE-2025-24813-POC

CVE-2025-24813 Proof-of-Concept Standalone This repository contains a non-destructive, standalone PoC for CVE-2025-24813, a vulnerability in Apache Tomcat 9.0.55 allowing remote file upload via partial PUT requests. This exploit demonstrates code execution by uploading and accessing a benign JSP...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Host Header Injection leading to SAML authentication bypass in Apache Airflow's AWS Auth Manager An attacker can inject a malicious Host header into the SAML login flow, causing the Assertion Consumer Service ACS URL to point to an attacker-controlled server. This allows the...