Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

apache tomcat xss vulnerabilities and exploits

(subscribe to this query)
NA

CVE-2024-52318

Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
6.1
CVSSv3

CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
Apache Tomcat 10.1.0Apache Tomcat
7.5
CVSSv3

CVE-2019-10072

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause serve...
Apache TomcatApache Tomcat 9.0.0
6.1
CVSSv3

CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be pr...
Apache TomcatApache Tomcat 9.0.0
7.5
CVSSv3

CVE-2019-0199

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that ut...
Apache TomcatApache Tomcat 9.0.0
6.1
CVSSv3

CVE-2018-8031

The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this applica...
Apache Tomee
NA

CVE-2014-0050

MultipartStream.java in Apache Commons FileUpload prior to 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote malicious users to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's ...
Oracle Retail Applications 12.0inOracle Retail Applications 13.0Oracle Retail Applications 13.3Oracle Retail Applications 13.2Oracle Retail Applications 12.0Oracle Retail Applications 14.0Oracle Retail Applications 13.1Oracle Retail Applications 13.4Apache Tomcat 7.0.2Apache Tomcat 7.0.49Apache Tomcat 7.0.12Apache Tomcat 7.0.20Apache Tomcat 7.0.34Apache Tomcat 7.0.8Apache Tomcat 7.0.1Apache Tomcat 7.0.5Apache Commons Fileupload 1.2.2Apache Tomcat 7.0.4Apache Tomcat 7.0.22Apache Tomcat 7.0.39Apache Tomcat 7.0.26Apache Tomcat 7.0.46
NA

CVE-2009-5120

The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote malicious users to conduct cross-site scripting (XSS) attacks vi...
Websense Websense Web Security 7.0Websense Websense Web Filter 7.0
NA

CVE-2011-1570

Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x prior to 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
Liferay Liferay Portal
NA

CVE-2011-0013

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 prior to 5.5.32, 6.0 prior to 6.0.30, and 7.0 prior to 7.0.6 allow remote malicious users to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Apache Tomcat 7.0.1Apache Tomcat 7.0.2Apache Tomcat 7.0.5Apache Tomcat 7.0.0Apache Tomcat 7.0.4Apache Tomcat 7.0.3Apache Tomcat 6.0.6Apache Tomcat 6.0.11Apache Tomcat 6.0.7Apache Tomcat 6.0.4Apache Tomcat 6.0.15Apache Tomcat 6.0.20Apache Tomcat 6.0.10Apache Tomcat 6.0.29Apache Tomcat 6.0.3Apache Tomcat 6.0.9Apache Tomcat 6.0.24Apache Tomcat 6.0.17Apache Tomcat 6.0Apache Tomcat 6.0.28Apache Tomcat 6.0.0Apache Tomcat 6.0.14
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-9474CVE-2024-36620file inclusioncache poisoningman-in-the-middleCVE-2024-20138CVE-2024-0012CVE-2024-20131CVE-2024-11995
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook