CVE-2019-12418

CVE-2019-12418 affects Apache Tomcat 9.0.0.M1–9.0.28, 8.5.0–8.5.47, 7.0.0–7.0.97 when JMX Remote Lifecycle Listener is enabled: a local attacker without Tomcat access can manipulate the RMI registry to perform a MITM and steal credentials to gain full control of the Tomcat instance. Connected adv...

CVE-2020-13935

CVE-2020-13935 affects Apache Tomcat: the WebSocket frame payload length was not properly validated, which could trigger an infinite loop and allow DoS via multiple invalid payloads. Affected: Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104. The initial d...

CVE-2020-17527

CVE-2020-17527 affects multiple Apache Tomcat releases where HTTP/2 stream handling could cause information leakage by reusing an HTTP request header value from a previous stream for the next stream. Affected products/versions include Tomcat 10.0.0-M1–M9, 9.0.0-M1–9.0.39, and 8.5.0–8.5.59; the is...

CVE-2020-11996

CVE-2020-11996 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35, and 8.5.0 to 8.5.55, where a specially crafted sequence of HTTP/2 requests could trigger high CPU and make the server unresponsive. Multiple connected advisories confirm this DoS through HTTP/2 traffic. Publ...

CVE-2020-13934

CVE-2020-13934 affects multiple Apache Tomcat releases (8.5.1–8.5.56, 9.0.x, 10.0.x up to M6) where an h2c direct connection didn’t release the HTTP/1.1 processor after upgrading to HTTP/2, potentially causing OutOfMemoryError and denial of service. Public advisories across vendors and distributi...

CVE-2013-3321

NetApp OnCommand System Manager 2.1 and earlier is affected by CVE-2013-3321 via a Local File Inclusion path exposed in the SnapMirror log/diagnostic area. Exploitation requires authentication as root to change the diagnostic path and read arbitrary files from the file system. The vulnerability i...

CVE-2016-3063

NetApp OnCommand System Manager contains an input-escaping flaw that affects versions before 8.3.2. Due to improper escaping of special characters, remote authenticated users can trigger arbitrary API calls via unspecified vectors. Impact is the ability to perform unintended API operations, with ...