apache tomcat 8.0 vulnerabilities and exploits

(subscribe to this query)

The postinst script in the tomcat6 package prior to 6.0.45+dfsg-1~deb7u4 on Debian wheezy, prior to 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package prior to 7.0.28-4+deb7u8 on Debian wheezy, prior to 7.0.56-3+deb8u6 on Debian jessie, prior to 7....

Debian Debian Linux 8.0 Debian Debian Linux 7.0 Canonical Ubuntu Linux 16.10 Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Apache Tomcat 8.0 Apache Tomcat 6.0 Apache Tomcat 7.0

The postrm script in the tomcat6 package prior to 6.0.45+dfsg-1~deb7u3 on Debian wheezy, prior to 6.0.45+dfsg-1~deb8u1 on Debian jessie, prior to 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package prior to 7.0.28-4+deb7u7 on Debian wheezy, prior to...

Debian Debian Linux 8.0 Debian Debian Linux 7.0 Canonical Ubuntu Linux 16.10 Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Apache Tomcat 8.0 Apache Tomcat 6.0 Apache Tomcat 7.0

The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed ...

Apache Tomcat Jk Connector Debian Debian Linux 8.0 Debian Debian Linux 9.0 Redhat Jboss Core Services -

8 Github repositories

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack...

Apache Tomcat Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Oracle Workload Manager 18c Oracle Workload Manager 19c Oracle Workload Manager 12.2.0.1 Canonical Ubuntu Linux 16.04 Opensuse Leap 15.1 Netapp Oncommand System Manager

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the si...

Apache Tomcat Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Opensuse Leap 15.1 Canonical Ubuntu Linux 16.04 Oracle Transportation Management 6.3.7 Oracle Retail Order Broker 15.0 Oracle Micros Relate Crm Software 11.4 Oracle Instantis Enterprisetrack Oracle Hyperion Infrastructure Technology 11.1.2.4 Oracle Agile Engineering Data Management 6.2.1.0 Oracle Mysql Enterprise Monitor

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network ...

2 Github repositories

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; a...

21 Github repositories

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located be...

It exists that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backport...

Canonical Ubuntu Linux 12.04 Debian Debian Linux 8.0 Canonical Ubuntu Linux 14.04

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exp...

62 Github repositories1 Article

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook