Apache Struts2 S2-008 RCE

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. id: CVE-2012-0392 info: name: Apache...

Apache OFBiz <17.12.06 - Arbitrary Code Execution

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. id: CVE-2021-26295 info: name: Apache OFBiz 17.12.06 - Arbitrary Code Execution author: madrobot severity: critical description: | Apache OFBiz...

Apache Tapestry - Remote Code Execution

Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the...

Apache OFBiz < 18.12.10 - Arbitrary Code Execution

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. id: CVE-2023-49070 info: name: Apache OFBiz 18.12.10 - Arbitrary Code Execution author: your3cho severity: critical description: | Pre-auth RCE in Apach...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. id: CVE-2020-17530 info: name: Apache Struts 2.0.0-2.5.25 - Remote Code Execution author: pikpikcu severity: critical...

CVE-2022-26134

pip3 install -r requirements.txt use: python3 exp.py url "cmd" example: python3 exp.py http://192.168.1.1/ whoami...

bug-bounty-reports-desai-vinayak

🧩 Bug Bounty Reports — Desai Vinayak 🔒 Bug bounty and vulnerability research reports by Desai Vinayak. This repository collects passive, non-destructive vulnerability write-ups and supporting evidence for coordinated disclosure and remediation tracking. 📁 Contents 📂 reports/ — PDF, DOCX, and...

CLEANSTART-2026-IS57850 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

CVE-2022-34169 affects multiple packages. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. See references for individual vulnerability details...

CLEANSTART-2026-PX58451 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...

CLEANSTART-2026-NB78178 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...

CLEANSTART-2026-XR18271 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

CVE-2026-84501 affects multiple packages. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",. See references for individual vulnerability details...

CLEANSTART-2026-NV45884 Apache Log4j's JsonTemplateLayout https://logging

Security vulnerability affects the spark-sc213-jdk17-py312 package. Apache Log4j's JsonTemplateLayout https://logging...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130142 advisory. Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130100 advisory. Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly JASPICServerAuthContext component...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130132)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130132 advisory. Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130126)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130126 advisory. Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130139 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130098)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130098 advisory. Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130099)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130099 advisory. Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathIn...