One PUT request, one poisoned session file, and the server’s yours A trivial flaw in Apache Tomcat that allows remote code ...