Apache

Tomcat

231 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2019-0221

  • EPSS 12.66%
  • Published 28.05.2019 22:29:00
  • Last modified 21.11.2024 04:16:31

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debu...

5.9

CVE-2019-2684

  • EPSS 0.99%
  • Published 23.04.2019 19:32:55
  • Last modified 21.11.2024 04:41:21

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthen...

9.3

CVE-2019-0232

  • EPSS 94.16%
  • Published 15.04.2019 15:29:00
  • Last modified 21.11.2024 04:16:33

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments...

7.5

CVE-2019-0199

  • EPSS 66.57%
  • Published 10.04.2019 15:29:00
  • Last modified 21.11.2024 04:16:28

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping str...

4.3

CVE-2018-11784

  • EPSS 82.62%
  • Published 04.10.2018 13:29:00
  • Last modified 21.11.2024 03:44:01

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause...

7.5

CVE-2018-1336

  • EPSS 16.09%
  • Published 02.08.2018 14:29:00
  • Last modified 21.11.2024 03:59:38

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and ...

5.9

CVE-2018-8037

  • EPSS 4.87%
  • Published 02.08.2018 14:29:00
  • Last modified 21.11.2024 04:13:09

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present ...

7.5

CVE-2018-8034

  • EPSS 20.88%
  • Published 01.08.2018 18:29:00
  • Last modified 21.11.2024 04:13:08

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

9.8

CVE-2018-8014

  • EPSS 53.05%
  • Published 16.05.2018 16:29:00
  • Last modified 21.11.2024 04:13:05

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter ...

5.9

CVE-2018-1304

  • EPSS 1.79%
  • Published 28.02.2018 20:29:00
  • Last modified 21.11.2024 03:59:35

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definiti...