tomcat: Security Manager bypass via persistence mechanisms

It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session...

tomcat: security manager bypass via setGlobalContext()

A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service...

Multiple F5 BIG-IP Product Denial of Service Vulnerabilities

F5 BIG-IP ASM Application Security Manager is a network security product from F5 Corporation, U.S.A. ASM is a comprehensive web application firewall that protects applications and data from known and unknown threats, defends against Trojans that bypass standard protections, and patches...

F5 BIG-IP ASM Denial of Service Vulnerability

F5 BIG-IP ASM Application Security Manager is a network security product from F5 Corporation, U.S.A. ASM is a comprehensive web application firewall that protects applications and data from known and unknown threats, defends against Trojans that bypass standard protections, and patches...

tomcat security, bug fix, and enhancement update

0:7.0.69-10 - Related: rhbz1368122 0:7.0.69-9 - Resolves: rhbz1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz1368122 0:7.0.69-7 - Resolves: rhbz1362545 0:7.0.69-6 - Related: rhbz1201409 Added /etc/sysconfig/tomcat to the systemd unit fo...

MGASA-2016-0367 Updated tomcat packages fix security vulnerability

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

RHEL 7 : tomcat (RHSA-2016:2599)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2599 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. The following packages have been upgraded t...

Moderate: Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

tomcat: security manager bypass via StatusManagerServlet

It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs...

tomcat: security manager bypass via setGlobalContext()

A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service...

tomcat: Security Manager bypass via persistence mechanisms

It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session...

tomcat: URL Normalization issue

A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or...

Apache Tomcat Security Manager Security Restriction Bypass Vulnerability (CNVD-2016-10423)

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat 7.0.0-7.0.70 suffers from a security restriction bypass vulnerability in its implementation. An attacker can exploit this vulnerability to bypass certain security restrictions and perform unauthorized operations...

Apache Tomcat Security Manager Security Restriction Bypass Vulnerability (CNVD-2016-10421)

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat 7.0.0-7.0.70 suffers from a security restriction bypass vulnerability in its implementation. An attacker can exploit this vulnerability to bypass certain security restrictions and perform unauthorized operations...

UBUNTU-CVE-2016-6794

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for...

UBUNTU-CVE-2016-5018

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

UBUNTU-CVE-2016-6796

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

tomcat -- multiple vulnerabilities

The Apache Software Foundation reports: Low: Unrestricted Access to Global Resources CVE-2016-6797 Low: Security Manager Bypass CVE-2016-6796 Low: System Property Disclosure CVE-2016-6794 Low: Security Manager Bypass CVE-2016-5018 Low: Timing Attack CVE-2016-0762...

Fixed in Apache Tomcat 6.0.47

Note: The issues below were fixed in Apache Tomcat 6.0.46 but the release vote for the 6.0.46 release candidate did not pass. Therefore, although users must download 6.0.47 to obtain a version that includes fixes for these issues, version 6.0.46 is not included in the list of affected versions...

tomcat: security manager bypass via StatusManagerServlet

It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs...