Apache Tomcat Reveals Path through Long URL

Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension...

Apache Tomcat allows webmasters to insert xss into error messages

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message...

GHSA-X445-MMPW-7R4F Apache Tomcat Allows Source Disclosure

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification i.e. HTTP/1.0...

Apache Tomcat Directory Traversal

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. dot dot in the argument to source.jsp...

GHSA-7WJ2-48C4-2684 Apache Tomcat Denial of Service vulnerability in the Catalina package

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.6 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests...

Apache Tomcat Denial of Service vulnerability in the Catalina package

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.6 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests...

Exploit for Code Injection in Vmware Spring_Framework

It is an exploit module targeting the Apache Log4j vulnerability...

A vulnerable version of Apache Tomcat was used in Jira Server (CVE-2020-9484, CVE-2022-23181)

Affected versions of Atlassian Jira Server and Data Center used versions of Apache Tomcat that were vulnerable to CVE-2020-9484 and CVE-2022-23181. The affected versions of Jira Server and Data Center are before version 8.13.20, from version 8.14.0 before 8.20.8, from version 8.21.0 before 8.22.2...

Oracle MySQL Enterprise Monitor (Apr 2022 CPU)

The version of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory. - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL component: Monitoring: General Apache Log4j. Supported versions that...

Security Bulletin: IBM Maximo For Civil infrastructure is vulnerable to a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Maximo For Civil infrastructure is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

Spring Framework Spring4Shell (CVE-2022-22965)

Binary data spring4shell.nbin...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965Spring4Shell CVE-2022-22965 Spring4Shell, Spr...

SpringShell RCE vulnerability: Guidance for protecting against and detecting CVE-2022-22965

April 11, 2022 update – Azure Web Application Firewall WAF customers with Regional WAF with Azure Application Gateway now has enhanced protection for critical Spring vulnerabilities - CVE-2022-22963, CVE-2022-22965, and CVE-2022-22947. See Detect and protect with Azure Web Application Firewall...

Exploit for Code Injection in Vmware Spring_Framework

Spring4shell RCE vulnerability This vulnerability affects Spr...

Security Bulletin: Cloud Pak for Security contains packages that have multiple vulnerabilities

Summary Cloud Pak for Security v1.9.0.0 and earlier may be vulnerable to multiple CVEs through the use of dependency packages. These have been updated in the latest release and vulnerabilities have neen addressed. Please follow the instructions in the Remediation/Fixes section below to update to...

Spring Framework RCE, Mitigation Alternative

Yesterday we announced a Spring Framework RCE vulnerability CVE-2022-22965, listing Apache Tomcat as one of several preconditions. The Apache Tomcat team has since released versions 10.0.20, 9.0.62, and 8.5.78 all of which close the attack vector on Tomcats side. While the vulnerability is not in...

Fixed in Apache Tomcat 10.0.20

Note: The issue below was fixed in Apache Tomcat 10.0.19 but the release vote for the 10.0.19 release candidate did not pass. Therefore, although users must download 10.0.20 to obtain a version that includes a fix for these issues, version 10.0.19 is not included in the list of affected versions...

PT-2022-11965

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.77 Apache Tomcat versions 9.0.0-M1 through 9.0.60 Apache Tomcat versions 10.0.0-M1 through 10.0.18 Apache Tomcat versions 10.1.0 through 10.1.0-M12 Description The simplified implementation of blocking...

Fixed in Apache Tomcat 9.0.62

Note: The issue below was fixed in Apache Tomcat 9.0.61 but the release vote for the 9.0.61 release candidate did not pass. Therefore, although users must download 9.0.62 to obtain a version that includes a fix for these issues, version 9.0.61 is not included in the list of affected versions. Hig...

Fixed in Apache Tomcat 10.1.0-M14

Note: The issue below was fixed in Apache Tomcat 10.1.0-M13 but the release vote for the 10.1.0-M13 release candidate did not pass. Therefore, although users must download 10.1.0-M14 to obtain a version that includes a fix for these issues, version 10.1.0-M13 is not included in the list of affect...