Security Bulletin: Security vulnerability has been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2018-11784)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about a security vulnerability affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-11784 DESCRIPTION: Apache Tomcat could...

Security Bulletin: A vulnerability in IBM WebSphere Application Server and WebSphere Liberty affects IBM Operations Analytics Predictive Insights (CVE-2014-7810)

Summary There is a vulnerability in IBM WebSphere Application Server and WebSphere Liberty that are used by IBM Operations Analytics Predictive Insights 1.3.6 and earlier versions. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. This issue was also addressed by IBM...

Arbitrary File Overwrite

Apache Tomcat Catalina is vulnerable to directory traversal. Lack of validation of WAR file name allows the attacker to create or overwrite arbitrary files using dot dot .. using a WAR filename...

Directory Traversal

Apache Tomcat Catalina is vulnerable to directory traversal. Lack of validation of WAR file name allows the attacker to delete the work-directory files using a WAR filename ...war...

Apache Tomcat 9.0.0.M1 < 9.0.10 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in WebSocket client because host name verification is missing - A flaw exists in NIO/NIO2 connectors due to a mishandling of close that can...

Apache Tomcat 7.0.41 < 7.0.79 Cache Poisoning Vulnerability

The version of Apache Tomcat installed on the remote host is 7.0.41 or later but prior to 7.0.79. It is, therefore, affected by a flaw in the CORS filter where the HTTP Vary header is not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks...

Apache Tomcat 7.0.x < 7.0.77 Information Disclosure

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.77. It is therefore affected by a flaw in the handling of pipelined requests when send file processing is used that results in the pipelined request being lost when processing...

Apache Tomcat 7.0.x < 7.0.78 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

Apache Tomcat 9.0.0.M1 < 9.0.5 Security Constraint Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.5. It is, therefore, affected by security constraints flaws which could expose resources to unauthorized users. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Tomcat 7.0.x < 7.0.81 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.81. It is, therefore, affected by multiple vulnerabilities : - An unspecified vulnerability when running on Windows with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false...

Apache Tomcat 7.0.28 < 7.0.88 Denial of Service

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.88. It is, therefore, affected by a denial of service due to a bug in UTF-8 decoder. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number...

Apache Tomcat 8.5.0 < 8.5.32 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.32. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in WebSocket client because host name verification is missing - A flaw exists in NIO/NIO2 connectors due to a mishandling of close that can...

Apache Tomcat 7.0.25 < 7.0.90 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is at least 7.0.25 and prior to 7.0.90. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in WebSocket client because host name verification is missing - A flaw exists in CORS filter due to insecure defaults Note tha...

Apache Tomcat 9.0.0.M1 < 9.0.0.M22 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.0.M22. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct...

Apache Tomcat 9.0.0.M22 < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.2. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.84. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 8.5.x < 8.5.13 Multiple Vulnerabilities

According to its self-reported version number, the Apache Tomcat service running on the remote host is 8.5.x prior to 8.5.13. It is therefore affected by multiple vulnerabilities : - A flaw exists in the handling of pipelined requests when send file processing is used that results in the pipeline...

Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

Apache Tomcat 8.5.x < 8.5.23 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.23. It is, therefore, affected by an unspecified vulnerability when running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false that makes it possible to upload a JSP...

Apache Tomcat 9.0.0.M1 < 9.0.1 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.1. It is, therefore, affected by an unspecified vulnerability when running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false that makes it possible t...