SC3010-Computer-Security

SC3010-Computer-Security — CVE-2017-5638 Attack Recreation This repository is part of the SC3010 Computer Security course project. It recreates CVE-2017-5638 , a critical Remote Code Execution vulnerability in Apache Struts 2 versions 2.3.5–2.3.31 and 2.5–2.5.10, famously exploited in the 2017...

CVE-2021-42013

CVE-2021-42013 취약한 서비스 설치 여러 옵션: 1. Docker 컨테이너 docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd CVE-2021-42013-Vulnerable-service/2.4.50 docker build -t apache2450cve-2021-42013 . docker run -d -p...

LOG4J-CVE-2021-44228

LOG4J-CVE-2021-44228 Log4Shell — CVE-2021-44228としても知られる — は、Apache FoundationのLog4jを使用するシステムにおいてリモートコード実行を可能にする深刻な脆弱性です。Log4jは、商用・オープンソースのソフトウェア製品やユーティリティで広く利用されているオープンソースのJavaライブラリです。 POC分析 脆弱なサーバーはポート8080で動作しています そして、ldapサーバーは2つのポート（http 8888 と ldap 1389）で動作しています エクスプロイトコマンド curl 172.17.0.2:808...

PT-2026-108894

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

PT-2026-108814

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description An issue exists in the OidcClientCodeRequestFilter where the max age authentication-freshness check is inoperative. This is...

PT-2026-108866

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The STSTokenValidator and Security Token Service STS cached validated security tokens using a non-cryptographic 32-bit hash...

PT-2026-108813

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description StaxUtils does not impose limits on the total number of elements or characters in an XML document by default. This allows a...

PT-2026-108810

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper verification of cryptographic signatures in the JAX-RS XML Security module allows for XML Signature wrapping. The...

PT-2026-108816

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The CompressionUtils.inflate function decompresses attacker-controlled DEFLATE data without an output-size cap, allowing a...

PT-2026-108817

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The OIDC relying-party component allows the redirection of users to an attacker-controlled URL following successful...

PT-2026-108867

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description An issue exists in the STSTokenValidator where the result of the SAML assertion signature check is stored in an object shared...

PT-2026-108818

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The FIQL query parser contains a flaw in its operator search mechanism. When processing a long string that lacks an operator,...

PT-2026-108815

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider allows a...

PT-2026-108893

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

PT-2026-108811

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The parser for multipart/MTOM attachment part headers fails to strictly enforce the attachment-max-header-size and...

PT-2026-108812

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...

Apache HugeGraph 1.7.0 SecurityManager Sandbox Bypass Remote Code Execution

Apache HugeGraph version 1.7.0 contains a SecurityManager sandbox bypass that allows unauthenticated remote command execution through the Gremlin endpoint. !/usr/bin/env bash Apache HugeGraph 1.7.0 Sandbox Bypass Remote Code Execution Vendor: The Apache Software Foundation Product web page:...

fastjson

fastjson Fastjson은 Java 객체를 JSON 표현으로 변환하는 데 사용할 수 있는 Java 라이브러리입니다. 또한 JSON 문자열을 동등한 Java 객체로 변환하는 데 사용할 수 있습니다. Fastjson은 소스 코드가 없는 기존 객체를 포함한 임의의 Java 객체와 함께 작동할 수 있습니다. FASTJSON 2.0.x가 출시되어 더 빠르고 안전하므로, 최신 버전으로 업그레이드하는 것을 권장합니다. Fastjson 목표 서버 사이드와 안드로이드 클라이언트에서 최고의 성능 제공 toJSONString 및...

ApacheRCEEssay

CVE-2021-41773 에세이 🕸️ 설명 🖼️ 이 저장소는 Apache 2.4.49의 원격 코드 실행 취약점인 CVE-2021-41773에 대한 에세이를 포함합니다. 이는 부쿠레슈티 폴리테크니카 대학교 자동제어 및 컴퓨터 학부의 "Cyberdefences and Cyberintelligence " 과목을 위해 작성되었습니다. 폴더 구조 📁 폴더 구조는 다음과 같습니다: demo : 취약한 웹 서버와 파이썬 익스플로잇 스크립트를 가진 공격자라는 두 개의 컨테이너로 구성된 Docker Compose 아키텍처의 개념 증명입니다...

Detections-CVE-2026-23918

이동 예정: https://github.com/insomnisec/publiccvedetections 탐지 게시물의 장기적인 관리를 위해 이 저장소는 2026년 6월에 제거됩니다 앞으로는 다른 저장소를 사용해 주세요 CVE-2026-23918 "Apache HTTP/2 Double-Free" — 탐지 및 대응 패키지 게시일: 2026-05-04 CVSSv3: 8.8 높음 유형: 원격 코드 실행 / 서비스 거부 Double-Free 메모리 손상 구성 요소: Apache HTTP Server modhttp2 h2mplx.c 스트림...