Vulmon Recent Vulnerabilities Trends Blog About Contact

apache tomcat vulnerabilities and exploits

(subscribe to this query)

5
CVSSv2
CVE-2018-1336
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86....
Apache TomcatApache Tomcat 8.0.0Apache Tomcat 9.0.0Redhat Jboss Enterprise Application Platform 6.0.0Redhat Jboss Enterprise Application Platform 6.4.0Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 16.04Debian Debian Linux 8.0Debian Debian Linux 9.0Redhat Jboss Enterprise Web Server 3.0.0Redhat Jboss Enterprise Web Server 5.0.0Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Workstation 7.0
5
CVSSv2
CVE-2018-8034
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88....
Apache TomcatApache Tomcat 8.0.0Apache Tomcat 9.0.0Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 16.04Debian Debian Linux 8.0Debian Debian Linux 9.0Oracle Retail Order Broker 5.1Oracle Retail Order Broker 5.2Oracle Retail Order Broker 15.0
4.3
CVSSv2
CVE-2018-8019
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked...
Debian Debian Linux 8.0Apache Tomcat Native
4.3
CVSSv2
CVE-2018-8020
Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users...
Debian Debian Linux 8.0Apache Tomcat Native
4.3
CVSSv2
CVE-2018-8031
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this...
Apache Tomee
4.3
CVSSv2
CVE-2016-0708
Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using...
Cloudfoundry Cf-releaseCloudfoundry Java Buildpack
7.5
CVSSv2
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have...
Apache TomcatApache Tomcat 8.0.0Apache Tomcat 9.0.0Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 17.10Canonical Ubuntu Linux 18.04Debian Debian Linux 8.0Netapp Oncommand Insight -Netapp Oncommand Unified ManagerNetapp Oncommand Workflow Automation -Netapp Snapcenter Server -Netapp Storage Automation Store -Netapp Oncommand Unified Manager
5
CVSSv2
CVE-2018-1323
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then...
Apache Tomcat Jk Connector
4.3
CVSSv2
CVE-2018-1304
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the...
Apache TomcatApache Tomcat 8.0.0Apache Tomcat 9.0.0Redhat Jboss Enterprise Application Platform 6Redhat Jboss Enterprise Application Platform 6.4Redhat Jboss Enterprise Web Server 3.0.0Debian Debian Linux 7.0Debian Debian Linux 8.0Debian Debian Linux 9.0Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 17.10Canonical Ubuntu Linux 18.04Oracle Fusion Middleware 12.2.1.3.0Oracle Hospitality Guest Access 4.2.0Oracle Hospitality Guest Access 4.2.1Oracle Micros Relate Crm Software 11.4Oracle Secure Global Desktop 5.3Oracle Secure Global Desktop 5.4Redhat Jboss Middleware 1
4
CVSSv2
CVE-2018-1305
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and...
Apache TomcatApache Tomcat 8.0.0Apache Tomcat 9.0.0Apache Tomcat 9.0.1Apache Tomcat 9.0.2Apache Tomcat 9.0.3Apache Tomcat 9.0.4Debian Debian Linux 7.0Debian Debian Linux 8.0Debian Debian Linux 9.0Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 17.10Canonical Ubuntu Linux 18.04Oracle Fusion Middleware 12.2.1.3.0Oracle Managed File Transfer 12.1.3.0.0Oracle Managed File Transfer 12.2.1.3.0Oracle Micros Relate Crm Software 11.4
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-3691insecure direct object referenceCVE-2021-1140CVE-2021-2109information disclosureCVE-2021-1303CVE-2021-1304IDORCVE-2020-14882