Tiny Java Web Server - Cross-Site Scripting

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. id: CVE-2021-37573 info: name: Tiny Java Web Server - Cross-Site Scripting author:...

log4j2-web-vulnerable

log4j2-web-vulnerable 一个用于 log4j2 RCE（CVE-2021-44228）漏洞测试的简单易受攻击的 Web 应用。 启动 运行 java -jar target/gs-handling-form-submission-0.1.0.jar。访问 http://127.0.0.1/greeting 如果你想自行编译，请使用 jdk 版本 8u20。...

log4shell-homework9

課題9 – Log4Shellエクスプロイトに対するシステムの保護 概要 このプロジェクトは、脆弱なLog4j 2.14.1を使用するDocker化されたJava Webアプリケーションを用いて、Log4Shellの脆弱性（CVE-2021-44228）の悪用と緩和を実証します。この構成には、JNDIインジェクション攻撃経路を実証するための、模擬的な悪意のあるLDAPサーバーも含まれます。 悪用後、Log4jのアップグレード、入力検証、MITRE D3FENDおよびATT&CKの推奨事項の適用により、システムは強化されます。 フォルダ構成 root@kitploit:...

apache-struts-cve-2017-9805

Apache Struts Web框架 Apache Struts Web框架是一个免费的开源解决方案，用于创建Java Web应用程序。 Web应用程序与传统网站的不同之处在于，Web应用程序可以创建动态响应。许多网站仅提供静态页面。Web应用程序可以与数据库和业务逻辑引擎交互以定制响应。 基于JavaServer Pages的Web应用程序有时会混杂数据库代码、页面设计代码和控制流代码。在实践中，我们发现除非将这些关注点分离，否则较大的应用程序将难以维护。...

undertow-io__undertow_CVE-2014-7816_1-0-16-Final

Undertow Undertow 是一个基于非阻塞 IO 的 Java Web 服务器。它由几个不同的部分组成： 一个同时支持阻塞和非阻塞 IO 的核心 HTTP 服务器 一个 Servlet 3.1 实现 一个符合 JSR-356 规范的 WebSocket 实现 网站：http://undertow.io 问题追踪：https://issues.jboss.org/browse/UNDERTOW 项目负责人：Stuart Douglas [email protected] 邮件列表：[email protected]...

l4s-vulnapp

Log4Shell 脆弱なアプリケーションl4s-vulnapp これは、log4shellCVE-2021-44228 の影響を受ける Log4j2.14.1 を含む、潜在的に脆弱な Java Web アプリケーションです。 検証済み環境と各種バージョン AdoptOpenJDK 17.0.10+7 Gradle 8.6 Gretty 4.1.2 Apache Tomcat 10.1.15 Apache Log4j Core 2.14.1 準備 AdoptOpenJDK のzipファイルをダウンロードして解凍します。 PATH と JAVAHOME 環境変数を設定します。...

web-inf-path-trav

WebXMLExp.py 用于帮助利用 Java Web 应用程序中路径遍历漏洞的工具。 该工具在 Invicti Security 白皮书 Exploiting path traversal vulnerabilities in Java web applications 中被引用。 安装 此工具需要 Python3。 运行以下命令： root@kitploit: pip install -r requirements.txt 用法： 安装后，按如下方式提供漏洞利用 URL： root@kitploit: usage: python WebXMLExp.py 结果（已下载的文件）位于...

DeliberatelyVulnerableWebApp

刻意存在漏洞的Web应用程序（Struts 2） 本项目是一个使用 Struts 2 框架的 Java Web 应用程序。它使用 Maven 构建，并可通过 Jetty 服务器运行。 前提条件 Java 开发工具包 JDK 8 或更高版本 Apache Maven 3.6.0 或更高版本 入门指南 构建项目 root@kitploit: mvn clean install 使用 Jetty 运行项目 root@kitploit: mvn jetty:run 访问应用程序 打开您的 Web 浏览器，访问 http://localhost:8080/dvwa。 项目结构...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Libraries. The supported versions affected include Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1, and 22.0.0.2. This easily...

CVE-2026-70906

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

BIT-JAVA-2026-47034

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

BIT-JAVA-2026-47030

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

EUVD-2026-46888

Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE...

PT-2026-62195

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u491 openjfx versions prior to 17.0.20.0-1.1 Description A flaw in the JavaFX component allows an unauthenticated attacker with network access to compromise the system. Exploitation requires human interaction and affect...

CVE-2026-10845

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications...

CVE-2026-10845 IBM WebSphere Application Server is affected by an authentication bypass vulnerability

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications...

CVE-2026-40128

SAP NetWeaver Application Server Java Web Container allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or...

CVE-2026-40128 Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

SAP NetWeaver Application Server Java Web Container allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution vulnerability (CVE-2026-9319)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution vulnerability when using JAX-WS endpoints with WS-Security. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...