7695 matches found
Authentication Bypass By Sniffing Valid Network Requests
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...
The vulnerability of the CORS component of Apache Tomcat servers allows attackers to access protected information.
The vulnerability of the CORS component in Apache Tomcat servers is related to insufficient access control. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected data using the HTTP protocol...
Apache Tomcat 7.0.0 < 7.0.70
The version of Tomcat installed on the remote host is prior to 7.0.70. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.70security-7 advisory. - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70...
Apache Tomcat 8.0.0.RC1 < 8.0.30
The version of Tomcat installed on the remote host is prior to 8.0.30. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.0.30security-8 advisory. - The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before...
Apache Tomcat < 8.0.0-RC10 Multiple Vulnerabilities
According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 8.0.0-RC10. It is, therefore, affected by multiple vulnerabilities: - The fix for CVE-2012-3544 was not complete and limits are not properly applied to chunk extensions and whitespac...
Apache Tomcat < 9.0.0.M3 Multiple Vulnerabilities
According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 9.0.0.M3. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists due to a failure to enforce access restrictions when handling...
Apache Tomcat 7.0.0 < 7.0.47 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 7.0.47. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.47security-7 advisory. - Jakarta Tomcat 5.0.19 Coyote/1.1 and Tomcat 4.1.24 Coyote/1.0 allows remote attackers to poison the web cache,...
Apache Tomcat 7.0.5 < 7.0.67
The version of Tomcat installed on the remote host is prior to 7.0.67. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.67security-7 advisory. - Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2,...
Apache Tomcat 7.0.28 < 7.0.88
The version of Tomcat installed on the remote host is prior to 7.0.88. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.88security-7 advisory. - An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop...
Apache Tomcat 7.0.0 < 7.0.76
The version of Tomcat installed on the remote host is prior to 7.0.76. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.76security-7 advisory. - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M...
Apache Tomcat 7.0.0 < 7.0.65
The version of Tomcat installed on the remote host is prior to 7.0.65. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.65security-7 advisory. - Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, an...
Apache Tomcat < 6.0.14 Multiple Vulnerabilities
According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.14. It is, therefore, affected by the following vulnerabilities : - Cross-site scripting XSS vulnerabilities exists due to improper validation of user-supplied input before...
Apache Tomcat 7.0.0 < 7.0.2
The version of Tomcat installed on the remote host is prior to 7.0.2. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.2security-7 advisory. - Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid...
Apache Tomcat < 6.0.6 Cross-Site Scripting
According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.6. It is, therefore, affected by the following vulnerability : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returnin...
Apache Tomcat < 6.0.10 Directory Traversal
According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.10. It is, therefore, affected by the following vulnerability : - A directory traversal vulnerability exists in Tomcat due to improper handling of certain path delimiters when...
Apache Tomcat 8.0.0.RC1 < 8.0.52
The version of Tomcat installed on the remote host is prior to 8.0.52. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.0.52security-8 advisory. - An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop...
Security Bulletin: Multiple Vulnerabilities in Apache Tomcat affects IBM UrbanCode Deploy (CVE-2018-11784)
Summary Previous releases of IBM UrbanCode Deploy are affected by multiple vulnerabilities in Apache Tomcat. Vulnerability Details CVEID: CVE-2018-11784 DESCRIPTION: Apache Tomcat could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the default...
VulnCheck KEV: CVE-2017-12615
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...
Apache Tomcat JK Connector (mod_jk) < 1.2.46 Authentication Bypass Vulnerability - Active Check
Apache Tomcat JK Connector modjk is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...
