CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT は、ライセンス応答サーブレットにおいて任意の攻撃者制御オブジェクトをデシリアライズすることにより、認証前のコマンドインジェクション脆弱性が存在します。 0x00 Dork shodan title:"GoAnywhere" FOFA title="GoAnywhere" 0x01 使用方法 Java バージョン java -version openjdk version "1.8.0362" ヘルプ java -jar CVE-2023-0669.jar -h / / | / / / | \ / \ | / / / // // ...

K000163434: Spring Boot vulnerability CVE-2026-40976

Security Advisory Description In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on t...

OracleOTM

OracleOTM CVE-2021-35616をエクスプロイトするためのPythonツール スクリプトはモジュールで動作し、以下の順序で実装しています。 ► ユーザー名列挙 ► デフォルト認証情報の検索 ► DBXMLサーブレットを使用したSQLクエリの実行 ► 完全なエクスプロイトとJSP実行 スクリプトの構文は次のとおりです。 .\OracleOTM.py module host TXT file additional parameters ユーザー名列挙: .\OracleOTM.py enum hosts TXT file -u users.txt デフォルト認証情報の検索:...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT 역직렬화 - Je Yiuwai의 블로그 CVE-2023-0669 CVE-2023-0669는 GoAnywhere MFT 역직렬화 취약점으로, 공격자가 제어하는 객체를 역직렬화하여 License Response Servlet에 사전 인증 명령 주입 취약점이 존재합니다. 공격자는 이 취약점을 이용하여 영향을 받는 시스템에서 임의 코드를 실행하여 시스템을 완전히 제어할 수 있습니다. 이 취약점은 7.1.2 이전 버전에 영향을 미치며 7.1.2는 포함되지 않습니다...

CVE-2025-68645

🛡️ CVE-2025-68645 - Zimbra ローカルファイルインクルージョン LFI 分析 📌 概要 このドキュメントでは、Zimbra Collaboration Suite に影響を及ぼす ローカルファイルインクルージョン LFI の脆弱性について説明します。 この問題は、以下のパラメータの不適切な処理に起因します。 /h/?javax.servlet.include.servletpath= これにより、認証されていないユーザーが内部アプリケーションリソースにアクセスできるようになります。 🔍 脆弱性の詳細 タイプ: ローカルファイルインクルージョン LFI アクセス:...

Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...

CVE-2019-0232

脆弱性環境 Tomcat 8.5.39 Jdk 8u121 web.xml ファイルの編集 cgi org.apache.catalina.servlets.CGIServlet debug 0 cgiPathPrefix WEB-INF/cgi-bin executable 5 cgi /cgi-bin/ content.xml ファイルの編集 WEB-INF/web.xml $catalina.base/conf/web.xml -- /Conte...

undertow-io__undertow_CVE-2014-7816_1-0-16-Final

Undertow Undertow は、ノンブロッキング IO をベースとした Java Web サーバーです。いくつかの異なる部分から構成されています: ブロッキング IO とノンブロッキング IO の両方をサポートするコア HTTP サーバー Servlet 3.1 実装 JSR-356 準拠の WebSocket 実装 Webサイト: http://undertow.io 課題: https://issues.jboss.org/browse/UNDERTOW プロジェクトリーダー: Stuart Douglas [email protected] メーリングリスト:...

CVE-2026-81626

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

EUVD-2026-83304

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-81626

IBM Guardium Data Protection 12.2 is affected by a SQL injection vulnerability (CWE-89) in the Load Balancer Groups component . An unauthenticated attacker can inject SQL statements through the Load Balancer Servlet endpoint over the network, requiring no user interaction or prior authentication....

CVE-2026-81626 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-81626 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-11540 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

EUVD-2026-83279

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-11540 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2023-54399 Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2023-54399 Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2026-11537

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...