Fedora 25 : 1:tomcat (2017-a00a087fd4)

This update includes a rebase from 8.0.44 up to 8.0.46 which resolves a single CVE along with various other bugs/features : - rh1480620 CVE-2017-7674 tomcat: Cache Poisoning Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 26 : 1:tomcat (2017-ab0def38cd)

This update includes a rebase from 8.0.44 up to 8.0.46 which resolves a single CVE along with various other bugs/features : - rh1480620 CVE-2017-7674 tomcat: Cache Poisoning Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Debian: Security Advisory (DSA-3974-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Red Hat JBoss EAP HTTP Header Injection Vulnerability

Red Hat JBoss Enterprise Application Platform EAP is the United States Red Hat Red Hat company's set of open source, J2EE-based middleware platform. The platform is mainly used to build, deploy and host Java applications and services. A security vulnerability exists in Red Hat JBoss EAP versions...

DEBIAN-CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

UBUNTU-CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

Design/Logic Flaw

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

CVE-2017-7561

CVE-2017-7561 affects Red Hat JBoss EAP, specifically versions 3.0.7 through before 4.0.0.Beta1. The underlying issue is in the JAX-RS component, allowing server-side cache poisoning or CORS-related flaws, with a moderate impact. The connected advisories (RHSA entries) corroborate the affected JB...

CVE-2017-7561

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact...

Crlf injection

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

CVE-2014-9564

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

CVE-2014-9564

IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware (versions up to 3.4.1110 and earlier) is affected by two vulnerabilities mapped to CVE-2014-9564 (CRLF injection leading to HTTP response splitting, Web cache poisoning and potentially XSS) and CVE-2014-9565 (CSRF/XSS-r...

CVE-2014-9564

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting XSS attack...

Cache Poisoning

resteasy-jaxrs is vulnerable to cache poisoning. The library does not add HTTP VARY: Origin headers to it’s responses, causing inaccurate caching when re-used across-origins...

Amazon Linux AMI : tomcat7 (ALAS-2017-873)

Security constrained bypass in error page mechanism : While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an...

Apache Tomcat 8.5.0 < 8.5.16 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.16security-8 advisory. - The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number...