CVE-2025-46701-o

CVE-2025-46701 Tomcat CVE, identificado por gregk4sec PÚBLICO PoC se publicó el 4 de junio de 2025...

CVE-2020-1938

CVE-2020-1938-tomcat-descarga de archivos + inclusión de archivos Vulnerabilidad de lectura de archivos del protocolo Tomcat-Ajp Fuente del PoC original: https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC/blob/master/poc.py Después de modificar, puede incluir archivos y, bajo ciertas...

spring-rce-poc

spring-rce-poc Probando CVE-2022-22968 Aplicación simple vulnerable a CVE-2022-22968 Dockerfile podría usarse para construirla en una versión vulnerable de Tomcat 9.0.59 exploit.sh es un script de shell que intenta explotar este CVE en el puerto 8080 de localhost Si el ataque con exploit.sh tiene...

Telstra-Cybersecurity-Virtual-Experience-

Programa de Experiencia Virtual en Ciberseguridad de Telstra Participé en el Centro de Operaciones de Seguridad de Telstra como Analista de Seguridad de la Información para obtener experiencia de primera mano sobre las tareas y responsabilidades diarias de un Analista de Seguridad en Telstra. Las...

CVE-2018-1305

Apache Tomcat 安全绕过漏洞 近日，Apache发布安全公告称Apache Tomcat 7、8、9多个版本存在安全绕过漏洞。攻击者可以利用这个问题，绕过某些安全限制来执行未经授权的操作，这可能有助于进一步攻击。 Apache Tomcat servlet 注释定义的安全约束，只在servlet加载后才应用一次。由于以这种方式定义的安全约束，应用于URL模式及该点下任何URL，很可能取决于servlet加载的次序，这可能会将资源暴露给未经授权访问它们的用户。 漏洞编号 CVE-2018-1305 影响版本 Apache Tomcat 9.0.5 Apache Tomcat...

Security update for tomcat

This update for tomcat fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

ghostcat

该工具利用 Apache Tomcat 中的一个 LFI 漏洞（CVE-2020-1938），不仅可以查看敏感文件，还可以运行恶意的 JSP 载荷。 可在此处下载（需要从命令行运行） 用法： ghostcat target HTTP port AJP port file read/eval...

CVE-2020-1938-Exploitation

CVE-2020-1938 悪用 Apache Tomcat における任意のJSPアップロードからRCEに至る脆弱性 説明 CVE-2020-1938 は、Apache Tomcat のバージョン 9.0.0.M1 から 9.0.0.30、8.5.0 から 8.5.50、および 7.0.0 から 7.0.99 に影響する重大な脆弱性です ⚠️ これは Hack The Box のラボで悪用されました。 🔗 参考: NIST NVD エントリ 偵察 攻撃ベクトルの特定 1. ウェブサイトでは Server Status 機能にデフォルトの認証情報が使用されている。 2...

spring4shell-poc

Spring4Shell POC Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run...

St2-052

S2-052的POC测试原名：Tomcat部署war） 原文地址：http://blog.csdn.net/caiqiiqi/article/details/77861477 从struts2的官网下载最后受影响的版本struts-2.5.12，地址： http://archive.apache.org/dist/struts/2.5.12/struts-2.5.12-apps.zip 注意下载struts-2.5.12-apps即可，不需要下载struts-2.5.12-all.zip。不然struts-2.5.12-all.zip中包含很多其他的东西，可以看到lib目录下有很多jar...

svja

svja RDPS 超级易受攻击 Java 应用程序（Super Vulnerable Java Application）顾名思义，就是一个超级易受攻击的 Java 应用程序，其创建目的是让所有人看到各种常见、往往“复杂”的漏洞。该软件是 Roniel 和 DaRon 播客节目（https://www.youtube.com/channel/UCbj1JFcSJeTuf3qf9GPRemA）的一部分，这样我们就可以以一种比网上许多其他工具更真实的方式来讨论和展示我们经常遇到的一些漏洞。要查看示例漏洞利用，请观看我们的播客。 重要...

Spring4Shell

Spring RCE CVE-2022-22965 漏洞环境 环境信息 springboot jdk11 tomcat9.0.30 payload 请求头配置 root@kitploit: "suffix": "%//", "c1": "Runtime", "c2": "%", "DNT": "1", "Content-Type": "application/x-www-form-urlencoded", 请求体数据 root@kitploit:...

CVE-2017-12615-PoC

CVE 2017-12615 Apache Tomcat Windows RCE ⚠️警告 这是一个针对已知 CVE 的概念验证环境与利用脚本，仅供学习和教育目的使用。 请勿在未获得明确授权的系统上使用这些脚本或技术。未经授权访问或利用系统是非法的，且违反道德。 📃描述 这是针对 CVE 2017-12615 的概念验证环境与利用脚本。 该漏洞出现在 Tomcat 中，需满足以下条件： 1. Servlet 上下文配置了 readonly=false 2. 允许 HTTP PUT 请求 攻击者可通过 PUT 请求上传 JSP 文件。Apache Tomcat...

BIT-TOMCAT-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

BIT-TOMCAT-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at...

BIT-TOMCAT-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, fr...

BIT-TOMCAT-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0...

BIT-TOMCAT-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through...

BIT-TOMCAT-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0 through 9.0.120. Th...

BIT-TOMCAT-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...