83696 matches found
apache-vulnerability-testing
Apache HTTP Server Vulnerability Testing Tool This repository provides a Proof of Concept PoC for testing various vulnerabilities in the Apache HTTP Server, including Filename Confusion Attacks, SSRF, Denial of Service, and others related to recent CVEs. The tool sends crafted HTTP requests to...
CVE-2024-50379
CVE-2024-50379 CVE-2024-50379 is a critical security vulnerability affecting Apache Tomcat, allowing attackers to exploit misconfigurations or weaknesses to achieve remote code execution RCE. When exploited, this vulnerability can lead to server compromise, data leakage, or privilege escalation...
CVE-2021-41773-L-
CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...
CVE-2025-31650
Apache Tomcat 10.1.39 - Denial of Service DoS This tool performs a high-volume, asynchronous HTTP/2 request flood using malformed priority headers to test the stability of Apache Tomcat servers running version 10.1.10 to 10.1.39. ⚠️ This is strictly for educational and research purposes only. ❌ Th...
Resource Exhaustion
Apache Thrift is vulnerable to resource exhaustion. The vulnerability is due to unbounded allocation of resources without proper throttling, where the Java bindings perform resource allocation without limits and attackers can trigger excessive resource consumption to cause denial of service...
CVE-2021-41773
CVE-2021-41773 — Apache Path Traversal & RCE Exploitation Writeup of the TryHackMe "Modern Web Stacks" room, focused on exploiting CVE-2021-41773 , a path traversal vulnerability in Apache HTTP Server 2.4.49 that leads to remote code execution when modcgi is enabled. Summary Item| Detail ---|---...
cve-2025-54988-VulnTikaProject
Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...
MGASA-2026-0502 Updated apache package fixes security vulnerabilities
Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...
Updated apache package fixes security vulnerabilities
Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...
Apache OFBiz <17.12.06 - Arbitrary Code Execution
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. id: CVE-2021-26295 info: name: Apache OFBiz 17.12.06 - Arbitrary Code Execution author: madrobot severity: critical description: | Apache OFBiz...
Apache Tapestry - Remote Code Execution
Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the...
Apache Struts2 S2-008 RCE
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. id: CVE-2012-0392 info: name: Apache...
Apache OFBiz < 18.12.10 - Arbitrary Code Execution
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. id: CVE-2023-49070 info: name: Apache OFBiz 18.12.10 - Arbitrary Code Execution author: your3cho severity: critical description: | Pre-auth RCE in Apach...
Apache Struts 2.0.0-2.5.25 - Remote Code Execution
Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. id: CVE-2020-17530 info: name: Apache Struts 2.0.0-2.5.25 - Remote Code Execution author: pikpikcu severity: critical...
bug-bounty-reports-desai-vinayak
🧩 Bug Bounty Reports — Desai Vinayak 🔒 Bug bounty and vulnerability research reports by Desai Vinayak. This repository collects passive, non-destructive vulnerability write-ups and supporting evidence for coordinated disclosure and remediation tracking. 📁 Contents 📂 reports/ — PDF, DOCX, and...
CLEANSTART-2026-IS57850 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
CVE-2022-34169 affects multiple packages. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. See references for individual vulnerability details...
CLEANSTART-2026-XR18271 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",
CVE-2026-84501 affects multiple packages. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",. See references for individual vulnerability details...
CLEANSTART-2026-NB78178 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...
CLEANSTART-2026-PX58451 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...