10 matches found
CVE-2026-111241
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...
EUVD-2026-121253
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...
CVE-2026-87755
Apache TomEE is vulnerable to stateful session bean hijacking because identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint and one valid identifier can derive identifiers for other clients' sessions. This allows the ...
CVE-2026-87755 Apache TomEE: Stateful session bean hijacking via predictable session identifiers
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...
EUVD-2026-121214
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...
CVE-2026-86811: Apache Software Foundation Apache TomEE: The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without…
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...
PT-2026-141724
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...
CVE-2026-111241: Apache Software Foundation Apache TomEE: When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to…
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...
PT-2026-141766
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...
CVE-2026-87755: Apache Software Foundation Apache TomEE: Stateful session bean identifiers are not generated from a cryptographically secure random source
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...