Apache Tomcat 安全漏洞

Apache Tomcat is a lightweight Web application server from the Apache Foundation. Apache Tomcat has a security vulnerability that could be exploited by an attacker to potentially compromise the confidentiality, availability, or integrity of the system. No details of the vulnerability are availabl...

KLA20148 ACE vulnerability in Apache Tomcat

Remote code execution vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Apache Tomcat 8.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-45143 critical Solution Update to the latest version...

Fixed in Apache Tomcat 8.5.84

Low: Apache Tomcat JsonErrorReportValve injection CVE-2022-45143 The JsonErrorReportValve did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Security Bulletin: Apache Tomcat could allow a remote attacker to obtain sensitive information (CVE-2021-43980)

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a long standing concurrency flaw in the simplified implementation of blocking reads and writes. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain...

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2022:4009-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4009-1 advisory. - CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. bsc1203868 Tenable has extracted the preceding...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2020-9484Exploit Exploit for Apache Tomcat deserializati...

KLA20149 ACE vulnerability in Apache Tomcat

Remote code execution vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Apache Tomcat 9.x vulnerabilities Apache Tomcat 10.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-45143 critical Soluti...

Fixed in Apache Tomcat 10.1.2

Low: Apache Tomcat JsonErrorReportValve injection CVE-2022-45143 The JsonErrorReportValve did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Fixed in Apache Tomcat 9.0.69

Low: Apache Tomcat JsonErrorReportValve injection CVE-2022-45143 The JsonErrorReportValve did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos Express.

Summary There are multiple vulnerabilities in Open Source Apache Tomcat that is used by IBM Cognos Express. Additionally, there are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM Cognos Express. This bulletin also addresses LOGJAM: The...

CVE-2022-42252

A flaw was found in Apache Tomcat. If the server is configured to ignore invalid HTTP headers, the server does not reject a request containing an invalid content-length header, making it vulnerable to a request smuggling attack...

PT-2022-7336

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.83, 9.0.40 through 9.0.68, 10.1.0-M1 through 10.1.1 Description The issue is related to the JsonErrorReportValve in Apache Tomcat, which does not properly escape the type, message, or description values. These values...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.5)

The version of AOS installed on the remote host is prior to 5.20.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.5 advisory. - In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication...

The vulnerability of the Apache Tomcat application server, related to synchronization errors when using shared resources, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Tomcat application server is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Apache Tomcat application server, related to synchronization errors when using shared resources, allows attackers to escalate their privileges.

The vulnerability of the Apache Tomcat application server is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to increase their privileges...

ROS-20221103-06

Apache Tomcat application server vulnerability is related to incorrect implementation of read/write locking. writes. Exploitation of the vulnerability could allow an attacker acting remotely to cause a concurrency error and force client connections to share an instance of Http11Processor...

Apache Tomcat 9.0.0.M1 < 9.0.68

The version of Tomcat installed on the remote host is prior to 9.0.68. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.68security-9 advisory. - If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configure...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.0 release and security update

Red Hat JBoss Web Server 5.7.0 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which give...

Apache Tomcat 8.5.0 < 8.5.83

The version of Tomcat installed on the remote host is prior to 8.5.83. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.83security-8 advisory. - If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configure...

RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.7.0 (RHSA-2022:7272)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7272 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...