Authentication flaw

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

CVE-2011-1184

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

CVE-2011-5063

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weak...

CVE-2011-5062

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability th...

CVE-2011-5064

The vulnerability CVE-2011-5064 affects Apache Tomcat’s HTTP Digest Access Authentication (DigestAuthenticator.java) where Catalina is used as the hard-coded server secret (private key). Affected are Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12. This weakness enables remot...

CVE-2011-5063

CVE-2011-5063 describes an issue in Apache Tomcat’s HTTP Digest Access Authentication where the realm values are not checked, enabling bypass of access controls by exploiting a protection space with weaker requirements (distinct from CVE-2011-1184). Related documents (CVE-2011-1184, CVE-2012-5885...

CVE-2011-1184

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

CVE-2011-5063

Removed by vendor...

CVE-2011-1184

The vulnerability CVE-2011-1184 affects Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12. The HTTP Digest Access Authentication implementation has insufficient replay-attack countermeasures due to lack of proper nonce and nc (nonce-count) checking, which can allow remot...

CVE-2011-5064

Removed by vendor...

CVE-2011-5064

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret aka private key, which makes it easier for remote attackers to bypass cryptographic...

CVE-2011-5062

CVE-2011-5062 affects Apache Tomcat’s HTTP Digest Access Authentication. The vulnerability arises because Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 do not check qop values, enabling remote attackers to bypass intended integrity protections via a qop=auth value. This is ...

CVE-2011-5062

Removed by vendor...

CVE-2011-1184

Removed by vendor...

Apache Tomcat 7.0.0 < 7.0.23

The version of Tomcat installed on the remote host is prior to 7.0.23. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.23security-7 advisory. - Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for...

Apache Tomcat 5.x < 5.5.35 Hash Collision Denial of Service

According to its self-reported version number, the instance of Apache Tomcat 5.x listening on the remote host is prior to 5.5.35. It is, therefore, affected by a denial of service vulnerability. Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions...

Apache Tomcat Detection (Windows SMB Login)

SMB login-based detection of Apache Tomcat. Copyright C 2012 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Apache Tomcat Hash Collision Denial Of Service Vulnerability

Apache Tomcat Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2011-4858

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

Code injection

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...