Security Bulletin: IBM UrbanCode Release is affected by CVE-2021-30639

Summary IBM UrbanCode Release version 6.2.5.3 - 6.2.5.4 are affected by CVE-2021-30639 Vulnerability Details CVEID: CVE-2021-30639 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by improper error handling during non-blocking I/O. By sending a specially-crafted request, a...

Fixed in Apache Tomcat 10.1.0-M10

Note: The issue below was fixed in Apache Tomcat 10.1.0-M9 but the release vote for the 10.1.0-M9 release candidate did not pass. Therefore, although users must download 10.1.0-M10 to obtain a version that includes a fix for these issues, version 10.1.0-M9 is not included in the list of affected...

Fixed in Apache Tomcat 8.5.75

Note: The issue below was fixed in Apache Tomcat 8.5.74 but the release vote for the 8.5.74 release candidate did not pass. Therefore, although users must download 8.5.75 to obtain a version that includes a fix for these issues, version 8.5.74 is not included in the list of affected versions. Low...

PT-2022-5376

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.55 through 8.5.73 Apache Tomcat versions 9.0.35 through 9.0.56 Apache Tomcat versions 10.0.0-M5 through 10.0.14 Apache Tomcat versions 10.1.0-M1 through 10.1.0-M8 Description The issue is related to a time of check,...

Fixed in Apache Tomcat 9.0.58

Note: The issue below was fixed in Apache Tomcat 9.0.57 but the release vote for the 9.0.57 release candidate did not pass. Therefore, although users must download 9.0.58 to obtain a version that includes a fix for these issues, version 9.0.57 is not included in the list of affected versions. Low...

Fixed in Apache Tomcat 10.0.16

Note: The issue below was fixed in Apache Tomcat 10.0.15 but the release vote for the 10.0.15 release candidate did not pass. Therefore, although users must download 10.0.16 to obtain a version that includes a fix for these issues, version 10.0.15 is not included in the list of affected versions...

KLA12436 PE vulnerability in Apache Tomcat

Privilege escalation vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to gain privileges. Original advisories Apache Tomcat 8.5.x vulnerabilities Apache Tomcat 9.x vulnerabilities Apache Tomcat 10.0.x vulnerabilities Related products Apache-Tomcat CVE list...

Security Bulletin: CVE-2021-42340 Apache Tomcat is vulnerable to a denial of service, caused by a memory leak flaw in WebSocket connections.

Summary Apache Tomcat is vulnerable to a denial of service, caused by a memory leak flaw in WebSocket connections. By sending a specially-crafted request using OutOfMemoryError, a remote attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details CVEID:...

Apache Tomcat Manager Bruteforced

The scanner successfully authenticated on the target Apache Tomcat manager interface by using weak or predictable credentials. No source data...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

vuln4japi A vulnerable Java based REST API for demonstrating C...

Request smuggling via a vulnerable version of Apache Tomcat - CVE-2021-33037

Affected versions of Atlassian Jira Server and Data Center used versions of Apache Tomcat that were vulnerable to request smuggling via CVE-2021-33037. The affected versions of Atlassian Jira Server and Data Center are before version 8.21.0. Affected versions: version 8.21.0 Fixed versions: 8.21....

EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2021-2816)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was...

The vulnerability of the Apache Tomcat application server, related to memory leaks, allows attackers to cause service failures.

The vulnerability of the Apache Tomcat application server is related to a memory leak. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by fixing the error 63362...

tomcat: Apache Tomcat HTTP/2 Request mix-up

A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - fro...

Security Bulletin: Multiple vulnerabilities in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional have addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID: CVE-2021-41079 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by improper input validation of TLS packets. By sending a specially-crafted...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

CVE-2017-12617 CVE-2017-12617 is a critical vulnerability lea...

RHEL 7 / 8 : Red Hat JBoss Web Server 5.6.0 Security (Important) (RHSA-2021:4861)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4861 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...

Denial of service via an OutOfMemoryError (Tomcat CVE-2021-42340)

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to impact the application's availability via CVE-2021-42340, a Denial of Service DoS vulnerability in Apache Tomcat. The affected versions of Atlassian Jira Server and Data Center are before version 8.21.0...

tomcat: JNDI realm authentication weakness

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.6.0 Security release

Red Hat JBoss Web Server 5.6.0 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which giv...