Apache

Tomcat

231 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2023-28709

  • EPSS 0.25%
  • Published 22.05.2023 11:15:09
  • Last modified 13.02.2025 17:16:16

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using...

4.3

CVE-2023-28708

  • EPSS 0.16%
  • Published 22.03.2023 11:15:10
  • Last modified 07.08.2025 11:15:26

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71...

7.5

CVE-2022-45143

  • EPSS 0.95%
  • Published 03.01.2023 19:15:10
  • Last modified 21.11.2024 07:28:50

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for u...

7.5

CVE-2022-42252

  • EPSS 0.15%
  • Published 01.11.2022 09:15:10
  • Last modified 06.05.2025 16:15:26

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request con...

3.7

CVE-2021-43980

  • EPSS 0.22%
  • Published 28.09.2022 14:15:09
  • Last modified 21.05.2025 15:15:55

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10...

6.1

CVE-2022-34305

  • EPSS 2.39%
  • Published 23.06.2022 11:15:07
  • Last modified 21.11.2024 07:09:15

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

8.6

CVE-2022-25762

  • EPSS 0.49%
  • Published 13.05.2022 08:15:06
  • Last modified 21.11.2024 06:52:57

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket a...

7.5

CVE-2022-29885

  • EPSS 68.72%
  • Published 12.05.2022 08:15:07
  • Last modified 21.11.2024 06:59:54

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct....

7

CVE-2022-23181

  • EPSS 0.23%
  • Published 27.01.2022 13:15:08
  • Last modified 21.11.2024 06:48:08

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privi...

7.5

CVE-2021-42340

  • EPSS 3%
  • Published 14.10.2021 20:15:09
  • Last modified 21.11.2024 06:27:38

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for We...