Apache

Tomcat

238 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2021-33037

  • EPSS 1.87%
  • Veröffentlicht 12.07.2021 15:15:08
  • Zuletzt bearbeitet 21.11.2024 06:08:10

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specific...

7

CVE-2021-25329

  • EPSS 0.8%
  • Veröffentlicht 01.03.2021 12:15:14
  • Zuletzt bearbeitet 21.11.2024 05:54:45

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnera...

7.5

CVE-2021-25122

  • EPSS 2.78%
  • Veröffentlicht 01.03.2021 12:15:13
  • Zuletzt bearbeitet 21.11.2024 05:54:23

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and use...

5.9

CVE-2021-24122

  • EPSS 53.94%
  • Veröffentlicht 14.01.2021 15:15:13
  • Zuletzt bearbeitet 21.11.2024 05:52:23

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. ...

7.5

CVE-2020-17527

  • EPSS 10.51%
  • Veröffentlicht 03.12.2020 19:15:12
  • Zuletzt bearbeitet 21.11.2024 05:08:17

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request asso...

4.3

CVE-2020-13943

  • EPSS 9.57%
  • Veröffentlicht 12.10.2020 14:15:12
  • Zuletzt bearbeitet 21.11.2024 05:02:11

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subs...

7.5

CVE-2020-13934

  • EPSS 23.38%
  • Veröffentlicht 14.07.2020 15:15:11
  • Zuletzt bearbeitet 21.11.2024 05:02:10

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException co...

7.5

CVE-2020-13935

  • EPSS 92.16%
  • Veröffentlicht 14.07.2020 15:15:11
  • Zuletzt bearbeitet 21.11.2024 05:02:10

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with inv...

7.8

CVE-2020-8022

Exploit
  • EPSS 0.19%
  • Veröffentlicht 29.06.2020 09:15:11
  • Zuletzt bearbeitet 21.11.2024 05:38:14

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise S...

7.5

CVE-2020-11996

  • EPSS 45.12%
  • Veröffentlicht 26.06.2020 17:15:10
  • Zuletzt bearbeitet 21.11.2024 04:59:04

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTT...