Fixed in Apache Tomcat 10.0.16

Note: The issue below was fixed in Apache Tomcat 10.0.15 but the release vote for the 10.0.15 release candidate did not pass. Therefore, although users must download 10.0.16 to obtain a version that includes a fix for these issues, version 10.0.15 is not included in the list of affected versions...

KLA12436 PE vulnerability in Apache Tomcat

Privilege escalation vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to gain privileges. Original advisories Apache Tomcat 8.5.x vulnerabilities Apache Tomcat 9.x vulnerabilities Apache Tomcat 10.0.x vulnerabilities Related products Apache-Tomcat CVE list...

CVE-2020-23181

CVE-2020-23181 is a reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 9.03.60. The flaw occurs in /administration/theme.php and can be exploited by an authenticated attacker who injects a crafted payload into the “Manage Theme” field to execute arbitrary web scripts or HTML in the ...