CVE-2020-1938
- EPSS 94.47%
- Veröffentlicht 24.02.2020 22:15:12
- Zuletzt bearbeitet 28.03.2025 17:15:49
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available t...
CVE-2020-1935
- EPSS 1.01%
- Veröffentlicht 24.02.2020 22:15:11
- Zuletzt bearbeitet 21.11.2024 05:11:38
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smug...
CVE-2019-17569
- EPSS 6.16%
- Veröffentlicht 24.02.2020 22:15:11
- Zuletzt bearbeitet 21.11.2024 04:32:33
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of H...
CVE-2019-17563
- EPSS 3.26%
- Veröffentlicht 23.12.2019 17:15:11
- Zuletzt bearbeitet 21.11.2024 04:32:32
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be p...
CVE-2019-2709
- EPSS 0.8%
- Veröffentlicht 23.04.2019 19:32:56
- Zuletzt bearbeitet 21.11.2024 04:41:24
Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.3.7, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows unauthenticated a...
CVE-2019-11358
- EPSS 2.4%
- Veröffentlicht 20.04.2019 00:29:00
- Zuletzt bearbeitet 21.11.2024 04:20:56
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the n...
CVE-2019-2487
- EPSS 0.27%
- Veröffentlicht 16.01.2019 19:30:33
- Zuletzt bearbeitet 21.11.2024 04:40:58
Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: UI Infrastructure). Supported versions that are affected are 6.3.7, 6.4.1, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows l...
CVE-2018-2823
- EPSS 0.27%
- Veröffentlicht 19.04.2018 02:29:05
- Zuletzt bearbeitet 21.11.2024 04:04:32
Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Database). The supported version that is affected is 6.4.3. Easily exploitable vulnerability allows low privileged attacker with netw...
CVE-2018-2662
- EPSS 0.26%
- Veröffentlicht 18.01.2018 02:29:21
- Zuletzt bearbeitet 21.11.2024 04:04:10
Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7 and 6.4.1. Easily exploit...
CVE-2018-2631
- EPSS 0.3%
- Veröffentlicht 18.01.2018 02:29:20
- Zuletzt bearbeitet 21.11.2024 04:04:05
Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: Security). Supported versions that are affected are 6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.1, 6.4.2 and 6.4.3. ...