81 matches found
openSUSE Security Advisory (SUSE-SU-2025:1521-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2025:1521-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2025:1521-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1521-1 advisory. Update to Tomcat 9.0.104 - CVE-2025-31650: invalid priority field values should be ignored bsc1242008 - CVE-2025-3165...
SUSE-SU-2025:1521-1 Security update for tomcat
This update for tomcat fixes the following issues: Update to Tomcat 9.0.104 - CVE-2025-31650: invalid priority field values should be ignored bsc1242008 - CVE-2025-31651: Better handling of URLs with literal ';' and '?' bsc1242009 Full changelog:...
Photon OS 5.0: Apache PHSA-2025-5.0-0519
An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0519. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.4 release and security update
Red Hat JBoss Web Server 5.8.4 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CV...
Mageia: Security Advisory (MGASA-2025-0145)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Exploit for Incomplete Cleanup in Apache Tomcat
TomcatKiller - CVE-2025-31650 šØ Proof of Concept PoC for Ap...
CVE-2025-31650
A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service DoS, causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak. Mitigation...
Exploit for Incomplete Cleanup in Apache Tomcat
TomcatKiller-CVE-2025-31650 A tool designed to detect the vuln...
CVE-2025-31650
CVE-2025-31650 affects Apache Tomcat and describes a DoS due to DoS via malformed HTTP/2 PRIORITY_UPDATE frames arising from improper input handling. Affects Tomcat 9.0.76ā9.0.102, 10.1.10ā10.1.39, and 11.0.0-M2ā11.0.5 (including older EOL 8.5.x in discussions). Debian/AlmaLinux advisories refere...
CVE-2025-31650
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial ...
CVE-2025-31650 Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial ...
CVE-2025-31650
creationtimestamp| type| source ---|---|--- 2025-04-28 17:42:38+00:00| seen| https://seclists.org/oss-sec/2025/q2/100 2025-04-28 19:40:35+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114417286197128762 2025-04-28 19:49:41+00:00| seen|...
Fixed in Apache Tomcat 11.0.6
Low: Rewrite rule bypass CVE-2025-31651 For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This was fixed with...
Fixed in Apache Tomcat 9.0.104
Note: The issues below were fixed in Apache Tomcat 9.0.103 but the release vote for the 9.0.103 release candidate did not pass. Therefore, although users must download 9.0.104 to obtain a version that includes a fix for these issues, version 9.0.103 is not included in the list of affected version...
KLA82886 DoS vulnerability in Apache Tomcat
Out of bounds memory read vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Denial of Service via invalid HTTP priority header Related products Apache-Tomcat CVE list CVE-2025-31650 critical Solution Update to...
Fixed in Apache Tomcat 10.1.40
Low: Rewrite rule bypass CVE-2025-31651 For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This was fixed with...
Advisory ROSA-SA-2025-2668
software: sox 14.4.2 OS: ROSA-CHROME packageevrstring: sox-14.4.2-6 CVE-ID: CVE-2022-31650 BDU-ID: 2023-01722 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the lsxaiffstartwrite function of the aiff.c component of the Sound eXchange audio editor is related to insufficient comparison. Exploitation ...
CVE-2024-31650
A cross-site scripting XSS in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter...