RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 4 (RHSA-2018:2469)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2469 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...

Photon OS 1.0: Apache / Binutils PHSA-2018-1.0-0154 (deprecated)

An update of 'apache-tomcat', 'binutils' packages of Photon OS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0154. The text itself is copyright...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update

An update is now available for Red Hat JBoss Web Server 3.1. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2018-1227)

According to the version of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are...

Amazon Linux AMI : tomcat7 / tomcat80 (ALAS-2018-1055)

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore,...

Amazon Linux AMI : tomcat8 (ALAS-2018-1056)

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore,...

Important: tomcat8

Issue Overview: The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default...

Apache Tomcat 7.0.0 < 7.0.89

The version of Tomcat installed on the remote host is prior to 7.0.89. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.89security-7 advisory. - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.R...

Apache Tomcat 9.0.0 < 9.0.9

The version of Tomcat installed on the remote host is prior to 9.0.9. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.9security-9 advisory. - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1...

EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2018-1220)

According to the version of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are...

Apache Tomcat 8.0.0.RC1 < 8.0.53 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.0.53security-8 advisory. - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by...

Debian: Security Advisory (DLA-1400-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1400-1] tomcat7 security update

Package : tomcat7 Version : 7.0.56-3+really7.0.88-1 CVE ID : CVE-2017-7674 CVE-2017-12616 CVE-2018-1304 CVE-2018-1305 CVE-2018-8014 Debian Bug : 802312 898935 Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2017-7674 The CORS Filter in Apache Tomcat...

Ubuntu: Security Advisory (USN-3665-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3665-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled being configured with HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP file to the server and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. CVE-2017-12616,...

CVE-2018-8014

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

CVE-2018-8014

CVE-2018-8014 affects the default configuration of Tomcat’s CORS filter, where default settings enable supportsCredentials for all origins across multiple releases (9.0.0.M1–9.0.8, 8.5.0–8.5.31, 8.0.0.RC1–8.0.52, 7.0.41–7.0.88). The issue is that environments relying on the default CORS configura...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3) +2996 more potentially affected by CVE-2018-8014 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =1.1.0 - ca.pjer:parse-security-spring-boot-starter 1.1.0 and more Source cves: CVE-2018-8014 Source advisory: MEND:CVE-2018-8014...

au.com.mountain-pass:hyperstate (>=1, <=9), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +1041 more potentially affected by CVE-2018-8014 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.0-rc1, <=8.0.52)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.0-rc1, =1, =0.0.6, =0.0.10, =2.0, =0.0.21, =0.0.21, =0.0.21, =0.0.25, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =1.1, =1.1.2 and more Source cves: CVE-2018-8014 Source advisory: MEND:CVE-2018-8014...