Apache Tomcat 7.0.28 < 7.0.88 Denial of Service

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.88. It is, therefore, affected by a denial of service due to a bug in UTF-8 decoder. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number...

Apache Tomcat 8.5.x < 8.5.23 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.23. It is, therefore, affected by an unspecified vulnerability when running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false that makes it possible to upload a JSP...

Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.84. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 9.0.0.M22 < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.2. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 9.0.0.M1 < 9.0.0.M22 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.0.M22. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct...

Apache Tomcat 9.0.0.M1 < 9.0.1 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.1. It is, therefore, affected by an unspecified vulnerability when running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false that makes it possible t...

Apache Tomcat 8.5.x < 8.5.13 Multiple Vulnerabilities

According to its self-reported version number, the Apache Tomcat service running on the remote host is 8.5.x prior to 8.5.13. It is therefore affected by multiple vulnerabilities : - A flaw exists in the handling of pipelined requests when send file processing is used that results in the pipeline...

Apache Tomcat 8.5.x < 8.5.28 Security Constraint Weakness

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.28. It is, therefore, affected by security constraints flaws which could expose resources to unauthorized users. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Tomcat 8.5.x < 8.5.16 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.16. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct client-side and server-side...

Apache Tomcat 8.5.0 < 8.5.31 Denial of Service

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.31. It is, therefore, affected by a denial of service due to a bug in UTF-8 decoder. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number...

Apache Tomcat 7.0.x < 7.0.82 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.82. It is, therefore, affected by an unspecified vulnerability when running on Windows with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false makes it possible to upload ...

Apache Tomcat 9.0.0.M1 < 9.0.12 Open Redirect

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 or 7.0.23 to 7.0.90. It is, therefore, affected by an open redirect vulnerability when the default servlet returned a redirect to a directory. Note that the scanner has not attempted to exploit these...

Apache Tomcat 7.0.23 < 7.0.91 Open Redirect

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 or 7.0.23 to 7.0.90. It is, therefore, affected by an open redirect vulnerability when the default servlet returned a redirect to a directory. Note that the scanner has not attempted to exploit these...

Apache Tomcat 8.5.0 < 8.5.34 Open Redirect

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 or 7.0.23 to 7.0.90. It is, therefore, affected by an open redirect vulnerability when the default servlet returned a redirect to a directory. Note that the scanner has not attempted to exploit these...

Apache Tomcat JK (mod_jk) Connector Directory Traversal Vulnerability

Apache Tomcat JK modjk Connector is a U.S. Apache Apache Software Foundation Apache for Apache or IIS to provide a connection to the backend Tomcat module , which supports clustering and load balancing and so on. A directory traversal vulnerability exists in Apache Tomcat JK modjk Connector...

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud

Summary There is a potential bypass security vulnerability in the expression language library used by WebSphere Application Server CVE-2014-7810. Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use ...

CVE-2018-11759

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...

CVE-2018-11759

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...

CVE-2018-11759

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...