Posts tagged: Apache

A long-standing flaw in Apache Struts lets unauthenticated attackers run commands on the server by abusing the method: prefix when Dynamic Method Invocation is switched on.

Tomcat’s EncryptInterceptor, meant to protect cluster traffic, can be bypassed, letting an attacker read sensitive data that should have been encrypted, no credentials needed.