apache tomcat vulnerabilities and exploits

(subscribe to this query)

6.1

CVSSv3

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability....

Apache Tomcat 10.1.0 Apache Tomcat3 Github repositories available

8.6

CVSSv3

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The...

Apache Tomcat

7.5

CVSSv3

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor...

Apache Tomcat 10.1.0 Apache Tomcat6 Github repositories available

9.8

CVSSv3

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar,...

Vmware Spring Framework Cisco Cx Cloud Agent Oracle Sd-wan Edge 9.0 Oracle Retail Xstore Point Of Service 20.0.1 Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.7.0 Oracle Financial Services Analytical Applications Infrastructure 8.1.1 Oracle Sd-wan Edge 9.1 Siemens Siveillance Identity 1.6 Siemens Siveillance Identity 1.5 Siemens Sipass Integrated 2.85 Siemens Sipass Integrated 2.80 Oracle Product Lifecycle Analytics 3.6.1 Oracle Financial Services Enterprise Case Management 8.1.1.0 Oracle Financial Services Enterprise Case Management 8.1.1.1 Oracle Financial Services Behavior Detection Platform 8.1.2.0 Oracle Financial Services Behavior Detection Platform 8.1.1.1 Oracle Financial Services Behavior Detection Platform 8.1.1.0 Oracle Communications Cloud Native Core Console 1.9.0 Oracle Communications Cloud Native Core Policy 1.15.0 Oracle Communications Cloud Native Core Unified Data Repository 1.15.0 Oracle Communications Cloud Native Core Unified Data Repository 22.1.0 Oracle Communications Cloud Native Core Security Edge Protection Proxy 22.1.0 Oracle Communications Cloud Native Core Policy 22.1.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.8.0 Oracle Communications Cloud Native Core Network Slice Selection Function 22.1.0 Oracle Communications Cloud Native Core Network Repository Function 1.15.0 Oracle Communications Cloud Native Core Network Repository Function 22.1.0 Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0 Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.10.0 Oracle Communications Cloud Native Core Network Exposure Function 22.1.0 Oracle Communications Cloud Native Core Console 22.1.0 Oracle Communications Cloud Native Core Automated Test Suite 22.1.0 Oracle Communications Cloud Native Core Automated Test Suite 1.9.0 Oracle Retail Xstore Point Of Service 21.0.0 Oracle Financial Services Enterprise Case Management 8.1.2.0 Oracle Financial Services Analytical Applications Infrastructure 8.1.2.0 Oracle Communications Policy Management 12.6.0.0.0 Oracle Mysql Enterprise Monitor Oracle Communications Cloud Native Core Network Slice Selection Function 1.15.0 Siemens Operation Scheduler Veritas Access Appliance 7.4.3 Veritas Access Appliance 7.4.3.100 Veritas Access Appliance 7.4.3.200 Veritas Netbackup Virtual Appliance 4.0.0.1 Veritas Netbackup Virtual Appliance 4.1.0.1 Veritas Netbackup Appliance 4.0.0.1 Veritas Netbackup Appliance 4.1.0.1 Veritas Netbackup Virtual Appliance 4.0 Veritas Netbackup Virtual Appliance 4.1 Veritas Netbackup Appliance 4.0 Veritas Netbackup Appliance 4.1 Veritas Flex Appliance 2.0 Veritas Flex Appliance 2.0.1 Veritas Flex Appliance 2.0.2 Veritas Flex Appliance 2.1 Veritas Flex Appliance 1.3 Veritas Netbackup Flex Scale Appliance 2.1 Veritas Netbackup Flex Scale Appliance 3.089 Github repositories available2 Articles available

7

CVSSv3

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the...

Apache Tomcat 10.0.0 Apache Tomcat 10.1.0 Apache Tomcat Oracle Managed File Transfer 12.2.1.3.0 Oracle Agile Engineering Data Management 6.2.1.0 Oracle Managed File Transfer 12.2.1.4.0 Oracle Mysql Enterprise Monitor Oracle Communications Cloud Native Core Policy 1.15.0 Oracle Financial Services Crime And Compliance Management Studio 8.0.8.2.0 Oracle Financial Services Crime And Compliance Management Studio 8.0.8.3.03 Github repositories available

7.5

CVSSv3

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the...

Apache Tomcat 10.0.0 Apache Tomcat 10.1.0 Apache Tomcat Netapp Hci -Netapp Management Services For Element Software -Debian Debian Linux 11.0 Oracle Sd-wan Edge 9.0 Oracle Hospitality Cruise Shipboard Property Management System 20.1.0 Oracle Sd-wan Edge 9.1 Oracle Communications Diameter Signaling Router Oracle Middleware Common Libraries And Tools 12.2.1.4.0 Oracle Retail Customer Insights 15.0.2 Oracle Retail Customer Insights 16.0.2 Oracle Taleo Platform Oracle Payment Interface 20.3 Oracle Payment Interface 19.1 Oracle Retail Eftlink 21.0.0 Oracle Retail Data Extractor For Merchandising 16.0.2 Oracle Retail Data Extractor For Merchandising 15.0.2 Oracle Retail Financial Integration 19.0.0 Oracle Retail Financial Integration 16.0.1 Oracle Retail Store Inventory Management 14.1.3.5 Oracle Retail Store Inventory Management 14.1.3.14 Oracle Retail Store Inventory Management 15.0.3.3 Oracle Retail Store Inventory Management 15.0.3.8 Oracle Retail Store Inventory Management 16.0.3.7 Oracle Retail Store Inventory Management 14.0.4.131 Github repository available

7.5

CVSSv3

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a...

Apache Tomcat Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Netapp Management Services For Element Software And Netapp Hci -

6.5

CVSSv3

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to...

Apache Tomcat Oracle Hospitality Cruise Shipboard Property Management System 20.1.0 Oracle Communications Diameter Signaling Router Oracle Communications Pricing Design Center 12.0.0.3.0 Oracle Tekelec Platform Distribution Oracle Communications Cloud Native Core Policy 1.14.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0

7.5

CVSSv3

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests....

Apache Tomcat 8.5.64 Apache Tomcat 9.0.44 Apache Tomcat 10.0.3 Apache Tomcat 10.0.4 Mcafee Epolicy Orchestrator Mcafee Epolicy Orchestrator 5.10.0 Oracle Big Data Spatial And Graph

5.3

CVSSv3

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly...

Apache Tomcat Apache Tomee 8.0.6 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Oracle Managed File Transfer 12.2.1.3.0 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3 Oracle Agile Plm 9.3.6 Oracle Communications Policy Management 12.5.0 Oracle Sd-wan Edge 9.0 Oracle Managed File Transfer 12.2.1.4.0 Oracle Secure Global Desktop 5.6 Oracle Hospitality Cruise Shipboard Property Management System 20.1.0 Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Communications Cloud Native Core Service Communication Proxy 1.14.0 Oracle Communications Diameter Signaling Router Oracle Communications Instant Messaging Server 10.0.1.5.0 Oracle Communications Pricing Design Center 12.0.0.3.0 Oracle Communications Session Report Manager Oracle Communications Session Route Manager Oracle Graph Server And Client Oracle Healthcare Translational Research 4.1.0 Oracle Mysql Enterprise Monitor Oracle Sd-wan Edge 9.1 Oracle Utilities Testing Accelerator 6.0.0.1.1 Oracle Utilities Testing Accelerator 6.0.0.2.2 Oracle Utilities Testing Accelerator 6.0.0.3.1 Mcafee Epolicy Orchestrator 5.10.0 Mcafee Epolicy Orchestrator

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook