Skip to content
Threat Feed
Subscribe

Product

Tomcat

7 briefs RSS
low advisory

Detection of Web Server Reconnaissance via Error Log Spikes

This brief covers the detection of automated reconnaissance activities, such as vulnerability scanning and fuzzing, which manifest as significant spikes in web server error logs.

HTTP Server +2 reconnaissance web-security log-analysis
1r 3t
low advisory

Detection of Unusual File Creation by Web Server Processes on Linux

This brief details a behavioral detection strategy for identifying potential web shell deployment and persistence mechanisms by monitoring anomalous file creation activities originating from common web server processes on Linux.

nginx +44 persistence web-shell linux behavioral-detection
1r 4t updated
critical advisory

IBM Langflow OSS Unauthenticated Remote Code Execution via Chained API Endpoints (CVE-2026-9198)

Unauthenticated attackers can achieve Remote Code Execution (RCE) on default IBM Langflow OSS deployments, versions 1.0.0 through 1.10.0, by chaining access to the `/api/v1/auto_login` endpoint, which mints SUPERUSER tokens, with the `/api/v1/validate/code` endpoint, which executes user-supplied code via `exec()`.

Langflow OSS +10 remote-code-execution api-exploitation unauthenticated-access code-injection web-vulnerability ai-llm
1r 3t 11c 2i updated
medium threat

Unusual Child Process Execution from Linux Web Servers

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Jira +20 persistence execution command_and_control initial_access linux webserver
2r 4t
medium threat

Suspicious Command Execution via Web Server on Linux

Identifies suspicious command executions via a web server on Linux systems, which may suggest a vulnerability and remote shell access.

Elastic Defend +43 persistence initial-access vulnerability linux
2r 3t
medium advisory

Apache Tomcat Security Bypass Vulnerability

A remote, anonymous attacker can exploit a vulnerability in Apache Tomcat to bypass security measures.

Tomcat apache security-bypass
2r 1t
high advisory

OpenMRS ModuleResourcesServlet Path Traversal Vulnerability

OpenMRS Core versions 2.7.8 and earlier, as well as versions 2.8.0 through 2.8.5, contain a path traversal vulnerability in the ModuleResourcesServlet, allowing an unauthenticated attacker to read arbitrary files from the server filesystem by manipulating the URL.

Tomcat +2 path-traversal information-disclosure openmrs
2r 1t