CVE-2025-24813

CVE-2025-24813 - Apache Tomcat 远程代码执行利用工具 这是 CVE-2025-24813 的概念验证（PoC）利用脚本，该漏洞存在于 Apache Tomcat（9.0.80–9.0.83、10.1.0–10.1.17）中，通过会话反序列化实现远程代码执行（RCE）。 该利用工具滥用部分 PUT 请求和 PersistentManager 会话存储机制来实现代码执行。 描述 Apache Tomcat 错误地处理不完整的文件上传。 攻击者可以通过发送带有 Content-Range 头的部分 PUT 请求，将精心构造的 Java 序列化对象作为 .sessi...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

CVE-2020-13768

🐞 CVE-2020-13768: MiniShare 1.4.1 - 基于栈的缓冲区溢出 MiniShare 1.4.1 中存在基于栈的缓冲区溢出，通过单个 HTTP PUT 请求即可触发。 📑 目录 此仓库存在的原因 此漏洞的有趣之处 背景与受影响软件 关于漏洞 触发崩溃 利用方法 🎓 此仓库存在的原因 此仓库是我在教授内存损坏利用时所使用的素材的一部分（除了日常工作，我还在多个网络安全课程中任教，帮助培养下一代逆向工程师）。 CVE-2020-13768 是我用来展示简单的面向网络的服务器如何通过标准协议方法暴露经典栈缓冲区溢出的案例。易受攻击的端点无需认证，溢出直接覆盖...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat：通过 Rewrite Valve 绕过目录保护 → 基于 PUT 的 RCE🚨🚨 摘要 CVE-2025-55752 是 Apache Tomcat 在修复 bug 60013 时引入的一个安全回归问题。当使用 Rewrite Valve 时，Tomcat 在 URL 解码 之前应用 路径规范化 。这种错误的顺序使得精心构造的 URI 能够绕过 StandardContextValve.java 中对 /WEB-INF/ 和 /META-INF/ 等受保护路径实施的访问检查。如果服务器接受 HTTP PUT...

cve-2019-6715

cve-2019-6715 感谢 TomNomNom，其代码贡献了本工具的 99.9%.... 构建 go get github.com/fatih/color go build 用法 cat list.txt | ./2019-6715 所有存在漏洞的 URL 都会记录在 text.log 中 CVE 2019-6715 描述：WordPress 的 W3 Total Cache 插件 0.9.4 之前版本中的 pub/sns.php 允许远程攻击者通过 SubscriptionConfirmation JSON 数据中的 SubscribeURL 字段读取任意文件。...

CVE-2023-3722

CVE-2023-3722 针对 Avaya Aura Device Services 不受限制的文件上传远程代码执行（RCE）漏洞（CVE-2023-3722）的 Python POC。 该脚本将使用 PUT 请求上传一个带有八位随机生成文件名的 PHP 文件，然后发起 GET 请求获取该文件并解析其输出，从而获得命令执行结果。 运行 python3 ./CVE-2023-3722.py example.com:444 --query "id" python3 ./CVE-2023-3722.py example.com:444 --query "hostname"...

CVE-2025-24813

Apache Tomcat 未认证远程代码执行 - CVE-2025-24813 本仓库提供指南和测试环境，用于评估 CVE-2025-24813 漏洞。 详情 受影响版本: Apache Tomcat 11.0.0-M1 至 11.0.2 Apache Tomcat 10.1.0-M1 至 10.1.34 Apache Tomcat 9.0.0.M1 至 9.0.98 参考 CVE-2025-24813 公告 Apache 公告 测试漏洞的步骤 1. 运行以下命令构建并启动存在漏洞的 Apache Tomcat 容器 docker build -t v-tomcat . docker...

CVE-2025-24813

CVE-2025-24813 针对 Apache Tomcat 中 CVE-2025-24813 漏洞的概念验证 PoC 脚本。 该脚本基于相关链接进行了修改，并根据我的需求进行了调整。 搭建漏洞环境（Tomcat） 提供的环境基于官方 Tomcat 9.0.90 镜像。它移除了服务器的只读限制，并配置其将会话数据保存到磁盘。然后，通过将 ROOT.war 文件复制到 Tomcat 的 webapps/ 目录，自动部署应用程序。 docker build -t cve-2025-24813 . docker run --name cve-2025-24813 -it -d -p...

Tomcat-CVE-2025-24813

使用条件 DefaultServlet 写入功能已启用：需要在 web.xml 中将 readonly 配置为 false 支持部分 PUT 请求：Tomcat 默认支持分块上传 启用文件会话持久化：需要在 context.xml 中配置 PersistentManager 和 FileStore 存在反序列化利用链：类路径中必须包含存在漏洞的库 影响范围 9.0.0.M1 readonly false 2. 你需要在 conf/context.xml 中启用文件会话存储。 version: '3.8' services: tomcat: image:...

CVE-2017-12615

curl -X PUT http://34.124.205.159:8080/1.jsp/ -d @- 1.jsp...

Ubuntu 26.04 LTS : OpenStack Swift vulnerability (USN-8821-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8821-1 advisory. It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could...

USN-8821-1 swift vulnerability

It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could possibly use this issue to cause OpenStack Swift to use excessive resources, leading to a denial of service...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

UBUNTU-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

Linux Distros Unpatched Vulnerability : CVE-2026-97149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method,...

CVE-2026-97149: Incomplete List of Disallowed Inputs

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

PT-2026-98459

Name of the Vulnerable Software and Affected Versions OpenStack Swift affected versions not specified Description An issue exists in the s3api middleware where truncated aws-chunked PUT request bodies are handled incorrectly. An authenticated attacker can exploit this behavior to cause the system...