tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

SUSE-SU-2026:22647-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve...

OPENSUSE-SU-2026:21328-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve...

CVE-2025-45869

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host...

CVE-2025-45869

LogicalDOC Enterprise (version up to and before v9.1.1 ) is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to force the server to initiate requests to an attacker-controlled ...

PT-2026-57853

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host...

Exploit for Command Injection in Fortra Goanywhere_Managed_File_Transfer

CVE-2025-10035 — Fortra GoAnywhere MFT License Servlet Deseria...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tomcat11: tomcat11-11.0.24-0.1.hum1 noarch tomcat11-admin-webapps-11.0.24-0.1.hum1 noarch tomcat11-common-11.0.24-0.1.hum1 noarch tomcat11-docs-webapp-11.0.24-0.1.hum1 noarch...

CVE-2026-55956

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources. Mitigation Review your...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

CVE-2017-12615 - Apache Tomcat Remote Code Execution RCE...

CVE-2022-50973

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

CVE-2022-50973 Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

EUVD-2022-56009

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

CVE-2022-50973 Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

CVE-2022-50973

Yonyou KSOA 9.0 is vulnerable to an unauthenticated arbitrary file upload flaw in the com.sksoft.bill.ImageUpload servlet. The root cause is a lack of authentication and validation for file types, extensions, or content when processing POST requests with attacker-controlled filepath and filename ...

CVE-2024-14037

CVE-2024-14037 describes an unauthenticated arbitrary file upload vulnerability in Redsea Cloud eHR via the PtFjk.mob servlet endpoint. An attacker can submit a multipart POST containing a JSP webshell disguised with a spoofed image/jpeg Content-Type, bypassing extension/MIME checks, resulting in...

PT-2026-55262

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without...

VulnCheck KEV: CVE-2022-50973

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any...

SUSE CVE-2026-55956

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from...

Improper Authorization

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Improper Authorization due to the improper enforcement of security constraints in the default...