PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tomcat CVE-2025-24813: What You Need to Know

bishopfox.com | vulnerability | CVE-2025-24813 | #rce | #deserialization | #vulnerability | #patching | #apache-tomcat | #cve-2025-24813
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Calm take on Tomcat CVE-2025-24813: exploitation needs rare non-default settings — writable servlet, partial PUT, file-based sessions, vulnerable deserialization — so most aren't at risk, but patch.
CVE
CVE-2025-24813
Published
Collected

Related coverage

vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · netspi.com
CVE-2025-26399 SolarWinds Web Help Desk Overview and Takeaways
CVE-2025-26399 is a critical unauthenticated deserialization flaw (CVSS 9.8) in SolarWinds Web Help Desk, a patch bypass now actively exploited and listed in CISA's KEV catalog.
vulnerability · bishopfox.com
Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
Bishop Fox maps NetScaler CVE-2026-19490, a CVSS 9.3 SAML bypass: one request runs post-login code, impact ranges from crash to internal proxy to root, plus a safe patch-state checker.
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
Back