The vulnerability of the JNDIRealm module implementation in Apache Tomcat applications allows a hacker to gain unauthorized access to protected information.

The vulnerability of the JNDIRealm module implementation in Apache Tomcat applications is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the non-blocking I/O implementation in the Apache Tomcat application server allows a hacker to cause a service failure.

The vulnerability of the non-blocking I/O implementation of the Apache Tomcat application server is related to deficiencies in handling exceptional conditions. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the Apache Tomcat application server, related to deficiencies in HTTP request processing, allows attackers to send hidden HTTP requests.

The vulnerability of the Apache Tomcat application server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely HTTP Request Smuggling attack...

Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins

Hello guys! The fourth episode of Last Week’s Security news, July 12 – July 18. I would like to start with some new public exploits. I think these 4 are the most interesting. If you remember, 2 weeks ago I mentioned the ForgeRock Access Manager and OpenAM vulnerability CVE-2021-35464. Now there i...

Apache Tomcat 10.0.0-M1 < 10.0.6 Authentication Weakness

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...

Apache Tomcat 9.0.0.M1 < 9.0.48 Request Smuggling

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.47 or 8.5.0 to 8.5.67. It is, therefore, affected by a request smuggling because Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances when used with a...

Apache Tomcat 8.5.x < 8.5.68 Request Smuggling

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.47 or 8.5.0 to 8.5.67. It is, therefore, affected by a request smuggling because Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances when used with a...

Apache Tomcat 10.0.3 < 10.0.5 Denial of Service

The version of Apache Tomcat installed on the remote host is 10.0.3 to 10.0.4, 9.0.44 or 8.5.64. It is, therefore, affected by a denial of service due to an error introduced as part of a change to improve error handling during non-blocking I/O. Note that the scanner has not attempted to exploit...

Apache Tomcat 9.0.0.M1 < 9.0.46 Authentication Weakness

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...

Apache Tomcat 9.0.44 Denial of Service

The version of Apache Tomcat installed on the remote host is 10.0.3 to 10.0.4, 9.0.44 or 8.5.64. It is, therefore, affected by a denial of service due to an error introduced as part of a change to improve error handling during non-blocking I/O. Note that the scanner has not attempted to exploit...

Apache Tomcat 8.5.64 Denial of Service

The version of Apache Tomcat installed on the remote host is 10.0.3 to 10.0.4, 9.0.44 or 8.5.64. It is, therefore, affected by a denial of service due to an error introduced as part of a change to improve error handling during non-blocking I/O. Note that the scanner has not attempted to exploit...

Apache Tomcat 7.0.x < 7.0.109 Authentication Weakness

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...

Apache Tomcat 8.5.x < 8.5.66 Authentication Weakness

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...

Apache Tomcat 10.0.0-M1 < 10.0.7 Request Smuggling

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.47 or 8.5.0 to 8.5.67. It is, therefore, affected by a request smuggling because Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances when used with a...

JetBlue: Access to tomcat-manager with default creds

The Apache Tomcat/6.0.35 server used by a domain was vulnerable to improper authentication due to the use of default credentials, allowing unauthorized access to the admin manager. The vulnerability was discovered and reported...

Upgrade the bundled version of Apache Tomcat to 8.5.68 or later

h3. Issue Summary The recently disclosed vulnerability regarding Apache Tomcat CVE-2021-33037|https://vulners.com/cve/CVE-2021-33037, CVE-2021-33037|https://nvd.nist.gov/vuln/detail/CVE-2021-33037 Base Score: 5.3 MEDIUM CVE-2021-42340|https://vulners.com/cve/CVE-2021-42340 NVD score not yet...

Upgrade the bundled version of Apache Tomcat to 8.5.68 or later

h3. Issue Summary The recently disclosed vulnerability regarding Apache Tomcat CVE-2021-33037|https://vulners.com/cve/CVE-2021-33037, CVE-2021-33037|https://nvd.nist.gov/vuln/detail/CVE-2021-33037 Base Score: 5.3 MEDIUM CVE-2021-42340|https://vulners.com/cve/CVE-2021-42340 NVD score not yet...

Apache Tomcat JNDI Realm Authentication Weakness Vulnerability (Jul 2021) - Windows

Apache Tomcat is prone to an authentication weakness vulnerability in the JNDI Realm. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS) Vulnerability

Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting XSS Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 CVE : CVE-2019-0221 Requirements: SSI support must be enabled within Apache Tomcat. SSI support is not enabled by...

Apache Tomcat HTTP Request Smuggling Vulnerability (Jul 2021) - Linux

Apache Tomcat is prone to an HTTP request smuggling vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...