Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

tomcat.apache.org vulnerabilities and exploits

(subscribe to this query)
7.5
CVSSv3
CVE-2018-11759
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed ...
Apache Tomcat Jk ConnectorDebian Debian Linux 8.0Debian Debian Linux 9.0Redhat Jboss Core Services -
4.8
CVSSv3
CVE-2019-17569
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomca...
Apache TomcatApache Tomee 7.0.7Opensuse Leap 15.1Netapp Oncommand System ManagerNetapp Data Availability Services -Debian Debian Linux 9.0Debian Debian Linux 10.0Oracle Transportation Management 6.3.7Oracle Hospitality Guest Access 4.2.0Oracle Hospitality Guest Access 4.2.1Oracle Agile Plm 9.3.3Oracle Agile Plm 9.3.5Oracle Agile Plm 9.3.6Oracle Instantis EnterprisetrackOracle Mysql Enterprise MonitorOracle Health Sciences Empirica Signal 7.3.3Oracle Communications Instant Messaging Server 10.0.1.4.0Oracle Workload Manager 18cOracle Workload Manager 19cOracle Workload Manager 12.2.0.1Oracle Agile Engineering Data Management 6.2.1.0Oracle Health Sciences Empirica Inspections 1.0.1.2
7.5
CVSSv3
CVE-2019-10072
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause serve...
Apache TomcatApache Tomcat 9.0.0
4.8
CVSSv3
CVE-2020-1935
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located be...
Apache Tomcat 9.0.0Apache TomcatDebian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Canonical Ubuntu Linux 16.04Opensuse Leap 15.1Netapp Oncommand System ManagerNetapp Data Availability Services -Oracle Transportation Management 6.3.7Oracle Hospitality Guest Access 4.2.0Oracle Hospitality Guest Access 4.2.1Oracle Retail Order Broker 15.0Oracle Agile Product Lifecycle Management 9.3.3Oracle Agile Product Lifecycle Management 9.3.5Oracle Agile Product Lifecycle Management 9.3.6Oracle Instantis EnterprisetrackOracle Health Sciences Empirica Signal 7.3.3Oracle Communications Instant Messaging Server 10.0.1.4.0Oracle Communications Element Manager 8.2.0Oracle Communications Element Manager 8.2.1Oracle Communications Element Manager 8.1.1
9.8
CVSSv3
CVE-2020-1938
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exp...
Apache TomcatApache Geode 1.12.0Fedoraproject Fedora 30Fedoraproject Fedora 31Fedoraproject Fedora 32Oracle Transportation Management 6.3.7Oracle Hospitality Guest Access 4.2.0Oracle Hospitality Guest Access 4.2.1Oracle Agile Plm 9.3.3Oracle Agile Plm 9.3.5Oracle Agile Plm 9.3.6Oracle Instantis EnterprisetrackOracle Mysql Enterprise MonitorOracle Health Sciences Empirica Signal 7.3.3Oracle Communications Instant Messaging Server 10.0.1.4.0Oracle Communications Element Manager 8.2.0Oracle Communications Element Manager 8.2.1Oracle Communications Element Manager 8.1.1Oracle Workload Manager 18cOracle Workload Manager 19cOracle Workload Manager 12.2.0.1Oracle Agile Engineering Data Management 6.2.1.0
7
CVSSv3
CVE-2019-12418
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack...
Apache TomcatDebian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Oracle Workload Manager 18cOracle Workload Manager 19cOracle Workload Manager 12.2.0.1Canonical Ubuntu Linux 16.04Opensuse Leap 15.1Netapp Oncommand System Manager
7.5
CVSSv3
CVE-2019-17563
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the si...
Apache TomcatDebian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Opensuse Leap 15.1Canonical Ubuntu Linux 16.04Oracle Transportation Management 6.3.7Oracle Retail Order Broker 15.0Oracle Micros Relate Crm Software 11.4Oracle Instantis EnterprisetrackOracle Hyperion Infrastructure Technology 11.1.2.4Oracle Agile Engineering Data Management 6.2.1.0Oracle Mysql Enterprise Monitor
NA
CVE-2007-2449
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 up to and including 4.0.6, 4.1.0 up to and including 4.1.36, 5.0.0 up to and including 5.0.30, 5.5.0 up to and including 5.5.24, and 6.0.0 up to and inc...
Apache Tomcat 4.0.4Apache Tomcat 5.5.18Apache Tomcat 5.0.8Apache Tomcat 5.0.19Apache Tomcat 6.0.6Apache Tomcat 6.0.11Apache Tomcat 5.5.12Apache Tomcat 5.0.14Apache Tomcat 5.5.14Apache Tomcat 5.5.10Apache Tomcat 5.0.22Apache Tomcat 5.5.4Apache Tomcat 5.5.7Apache Tomcat 5.5.1Apache Tomcat 5.0.7Apache Tomcat 6.0.7Apache Tomcat 5.5.11Apache Tomcat 6.0.4Apache Tomcat 5.5.6Apache Tomcat 5.0.9Apache Tomcat 5.0.15Apache Tomcat 5.0.30
NA
CVE-2008-1947
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 up to and including 5.5.26 and 6.0.0 up to and including 6.0.16 allows remote malicious users to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Apache Tomcat 5.5.18Apache Tomcat 6.0.6Apache Tomcat 6.0.11Apache Tomcat 5.5.12Apache Tomcat 5.5.14Apache Tomcat 5.5.10Apache Tomcat 6.0.7Apache Tomcat 5.5.11Apache Tomcat 6.0.4Apache Tomcat 5.5.26Apache Tomcat 5.5.20Apache Tomcat 5.5.15Apache Tomcat 6.0.15Apache Tomcat 5.5.21Apache Tomcat 5.5.22Apache Tomcat 6.0.10Apache Tomcat 6.0.3Apache Tomcat 6.0.9Apache Tomcat 5.5.9Apache Tomcat 5.5.25Apache Tomcat 6.0.0Apache Tomcat 6.0.14
NA
CVE-2011-0013
Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 prior to 5.5.32, 6.0 prior to 6.0.30, and 7.0 prior to 7.0.6 allow remote malicious users to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Apache Tomcat 7.0.1Apache Tomcat 7.0.2Apache Tomcat 7.0.5Apache Tomcat 7.0.0Apache Tomcat 7.0.4Apache Tomcat 7.0.3Apache Tomcat 6.0.6Apache Tomcat 6.0.11Apache Tomcat 6.0.7Apache Tomcat 6.0.4Apache Tomcat 6.0.15Apache Tomcat 6.0.20Apache Tomcat 6.0.10Apache Tomcat 6.0.29Apache Tomcat 6.0.3Apache Tomcat 6.0.9Apache Tomcat 6.0.24Apache Tomcat 6.0.17Apache Tomcat 6.0Apache Tomcat 6.0.28Apache Tomcat 6.0.0Apache Tomcat 6.0.14
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
race conditionCVE-2024-4249CVE-2024-4244CVE-2023-20198TCPCVE-2022-48648CVE-2022-48636CVE-2024-21345SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook