Apache Tomcat 安全漏洞

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server . Used to implement the Servlet and JavaServer Page JSP support. Apache Tomcat has a resource management issue vulnerability that stems from the presence of uncontrolled resource consumption, which...

PT-2024-36285 · Unknown · Flaming Forms

Name of the Vulnerable Software and Affected Versions: Flaming Forms versions 1.0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and al...

CVE-2024-11986

Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scriptin...

CVE-2024-11986

CVE-2024-11986 involves improper input handling of the Host Header in CrushFTP, allowing an unauthenticated attacker to craft input that is stored in web application logs and can execute when an Administrator views the logs. Connected sources identify CrushFTP as the affected product and note the...

Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2025-02844)

Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. Adobe Connect suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an...

MAL-2024-11788 Malicious code in web-app-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec79d580d43f835fcecc4698a0de40fde087ff79c80f5941edc641892528eb16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for CVE-2024-4956

CVE-2024-4956 CVE-2024-4956 is a serious path traversal vulne...

CVE-2024-28141

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141 Cross-Site Request-Forgery

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141 Cross-Site Request-Forgery

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141

CVE-2024-28141 describes a Cross-Site Request Forgery vulnerability in a web application used by Image Access Scan2Net. The issue allows an attacker to trick authenticated users into performing actions on the application (e.g., resetting an admin password or creating new users) when visiting a ma...

Image Access Scan2Net 安全漏洞

Image Access Scan2Net is a scanning software from Image Access Germany. A security vulnerability exists in Image Access Scan2Net that originates from a web application that is not protected against cross-site request forgery attacks...

What You Should Know About BreakingWAF

BreakingWAF is not a vulnerability stemming from WAF solutions — it is a misconfiguration vulnerability that can be addressed during customer onboarding...

PT-2025-26186

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.11.11 Description An unauthenticated malicious actor can execute arbitrary code by using the '/locales/locale.json' endpoint with the locale and namespace query parameters. This flaw allows for complete server...

Drupal XSS Vulnerability (SA-CORE-2024-003) - Windows

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

SAP Adobe Document Service 代码问题漏洞

Adobe Document Service is a service provided by Adobe for processing documents, supporting PDF creation, editing and other functions. A code issue exists in Adobe Document Service that originates from a vulnerability that allows an attacker with administrator privileges to send a specially crafte...

CVE-2024-50625

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when...

CVE-2024-50625

Digi ConnectPort LTS prior to 1.4.12 is affected by a vulnerability in the web application’s file upload handling that allows manipulation of the file path via POST requests. This can enable arbitrary file uploads within specific directories and potentially lead to privilege escalation when combi...

Fixed in Apache Tomcat 11.0.2

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete - CVE-2024-56337 The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 11.0.2 or later, users running Tomcat on a case insensitive file system with the...

Fixed in Apache Tomcat 9.0.98

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete - CVE-2024-56337 The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 9.0.98 or later, users running Tomcat on a case insensitive file system with the...