Posted by disclosure via Fulldisclosure on Oct 150day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear Collaborator Server 15.1.15101, the closed-source peer and technical code-review platform from SmartBear that runs as a Java web application on Apache Tomcat. One low-privilege authenticated account plants a Groovy Server Page in the Tomcat webroot through an archive-extraction path traversal, and any anonymous client - a crawler, a scanner, anyone - then executes it...