13543 matches found
The vulnerability of the Apache Tomcat application server, related to deficiencies in the error reporting mechanism, allows attackers to execute a type of attack known as Padding Oracle attack.
The vulnerability of the Apache Tomcat application server is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability allows a malicious actor to carry out a type of attack known as Padding Oracle, which involves using “padding” to manipulate data...
Apache Tomcat 10.1.22 < 10.1.54 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 10.1.54. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.54security-10 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clusteri...
Apache Tomcat 11.0.0.M14 < 11.0.21 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 11.0.21. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.21security-11 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clusteri...
Apache Tomcat 9.0.113 < 9.0.116 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 9.0.116. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.116security-9 advisory. - CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled...
Apache Tomcat 9.0.92 < 9.0.117 Improper Authentication Vulnerability (CVE-2026-34500)
The version of Tomcat installed on the remote host is 9.0.92 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled and...
Apache Tomcat 10.1.50 < 10.1.53 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 10.1.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.53security-10 advisory. - CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled...
The vulnerability of the Apache Tomcat application server, related to deficiencies in the encryption of confidential data, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Apache Tomcat application server is related to deficiencies in the encryption of confidential data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
Exploit for Missing Encryption of Sensitive Data in Apache Tomcat
CVE-2026-34486-Tribes Apache Tomcat Tribes cluster communicat...
Apache Tomcat 11.0.15 < 11.0.20 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 11.0.20. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.20security-11 advisory. - Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability in Apache Tomcat via the...
tomcat: Client certificate verification bypass due to virtual host mapping
A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...
org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve
A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...
org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation
An improper input neutralization flaw has been discovered in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a...
tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation
A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tomcat10: tomcat10-10.1.54-1.hum1 noarch tomcat10-admin-webapps-10.1.54-1.hum1 noarch tomcat10-common-10.1.54-1.hum1 noarch tomcat10-docs-webapp-10.1.54-1.hum1 noarch...
tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service
A denial of service flaw has been discovered in Apache Tomcat. If an error occurred including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete...
tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...
tomcat: security constraint bypass with HTTP/0.9
A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...
Exploit for Missing Encryption of Sensitive Data in Apache Tomcat
CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apa...