133 matches found
CVE-2021-27850_POC
CVE-2021-27850 漏洞利用 概述 CVE-2021-27850 是 Apache Tapestry 所有最新版本中发现的一个严重未经认证的远程代码执行漏洞。通过下载 AppModule.class 文件，我们可以泄露用于签名 Apache Tapestry 中所有序列化对象的 HMAC 密钥。 我们在一次真实环境评估中遇到了这个 CVE，并且据我所知，目前还没有关于 Tapestry 如何签名序列化对象的公开利用工具，因此我们决定发布以下 POC，这是我们在长时间研究 Apache Tapestry 源代码之后使用的 x。 使用方法 1- 克隆此仓库 2- 运行以下命令...
CVE-2021-27850_POC
CVE-2021-27850 利用工具 概述 CVE-2021-27850 是一个严重的未授权远程代码执行漏洞，存在于所有最新版本的 Apache Tapestry 中。通过下载 AppModule.class 文件，我们可以泄露用于签署 Apache Tapestry 中所有序列化对象的 HMAC 密钥。 我们在一次真实的渗透测试中遇到了这个 CVE，据我所知，目前还没有关于 Tapestry 如何签署序列化对象的公开利用方法，因此我们决定发布以下 PoC，这是我们深入分析 Apache Tapestry 源码后使用的（笑）。 感谢我的前辈Fares 使用方法 1- 克隆此仓库 2-...
CVE_2021_27850_POC
命令使用 root@kitploit: git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command 假设 hmac key为 change this...
asf__tapestry-5_CVE-2019-0207_5-4-4
Dieses Repository hat keine README-Datei...
Apache Tapestry - Remote Code Execution
Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the...
CVE-2026-61899
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
CVE-2026-61899
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
EUVD-2026-55243
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
CVE-2026-61899
CVE-2026-61899 affects tapestry-core (Apache Tapestry 5.5.0+) on all platforms. The issue allows an attacker to download classpath assets via specially crafted URLs, due to a vulnerability in tapestry-core. Impact is described as high with network exploitability and no user interaction. The recom...
CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
CVE-2021-27850
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was...
CVE-2022-31781
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service ReDoS in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on...
EUVD-2019-0738
Malware in sbrugna...
EUVD-2022-3496
Malicious code in bioql PyPI...
EUVD-2022-1222
Malicious code in bioql PyPI...
EUVD-2022-6199
Malicious code in bioql PyPI...
EUVD-2022-1426
Malicious code in bioql PyPI...
