CVE-2013-4590

CVE-2013-4590 affects Apache Tomcat prior to 6.0.39, 7.x prior to 7.0.50, and 8.x prior to 8.0.0-RC10. The issue is an XML External Entity (XXE) vulnerability that lets an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld document containing an external entity declar...

CVE-2013-6357

CVE-2013-6357 affects the Apache Tomcat Manager application and can enable CSRF to hijack administrator sessions for actions that manipulate deployments via POST requests (notably undeploy via /manager/html/undeploy?path=). It targets Tomcat 5.5.25 and earlier. The description notes that the vend...

CVE-2013-4286

CVE-2013-4286 affects Apache Tomcat: HTTP/AJP connectors may mishandle inconsistent headers, allowing remote request-smuggling via multiple Content-Length headers or Content-Length with Transfer-Encoding: chunked. Affected: Tomcat 6.x before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3. Ro...

CVE-2013-4322

CVE-2013-4322 affects Apache Tomcat on multiple branches and is caused by improper handling of chunked transfer encoding trailing headers/extensions, allowing remote DoS by streaming data. Affects Tomcat 6.x up to 6.0.39, 7.x up to 7.0.50, and 8.x up to 8.0.0-RC10, and stems from an incomplete pr...