CVE-2020-1938

CVE-2020-1938 (Tomcat AJP vulnerability) : The issue affects Apache Tomcat where the AJP Connector, enabled by default in several legacy releases, could be reached through untrusted networks. An attacker could exploit the configured AJP path to read arbitrary files in the web application and pote...

CVE-2020-9484

CVE-2020-9484 is a deserialization flaw in Apache Tomcat that, under a specific FileStore PersistenceManager configuration and a crafted request, can trigger remote code execution. Affected are Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107 when the...

CVE-2020-1935

CVE-2020-1935 affects Apache Tomcat across multiple branches: 9.0.0.M1–9.0.30, 8.5.0–8.5.50, and 7.0.0–7.0.99. It stems from HTTP header parsing that can mishandle end-of-line and Transfer-Encoding, enabling HTTP Request Smuggling when Tomcat sits behind certain reverse proxies. Impact is informa...

CVE-2019-17563

Tomcat CVE-2019-17563: A race-condition in FORM authentication allowed a session-fixation window in Tomcat 9.0.0.M1–9.0.29, 8.5.0–8.5.49, and 7.0.0–7.0.98. The issue is acknowledged as a vulnerability with practical exploitation not detailed in the provided docs. Affected products: Apache Tomcat....

CVE-2021-45105

Summary of CVE-2021-45105 (Log4j2) : Affected Log4j 2.x versions 2.0-alpha1 through 2.16.0 (except 2.12.3 and 2.3.1) are vulnerable to denial of service via uncontrolled recursion triggered by self-referential lookups in Thread Context Map data. The root cause is improper handling of self-referen...

CVE-2016-8735

CVE-2016-8735 is a remote code execution vulnerability in Apache Tomcat via JmxRemoteLifecycleListener. Affected are Tomcat releases before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JMX ports are reachable. Root cause: JmxRemoteLifecycleListe...

CVE-2020-13935

CVE-2020-13935 affects Apache Tomcat: the WebSocket frame payload length was not properly validated, which could trigger an infinite loop and allow DoS via multiple invalid payloads. Affected: Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104. The initial d...

CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2020-13934

CVE-2020-13934 affects multiple Apache Tomcat releases (8.5.1–8.5.56, 9.0.x, 10.0.x up to M6) where an h2c direct connection didn’t release the HTTP/1.1 processor after upgrading to HTTP/2, potentially causing OutOfMemoryError and denial of service. Public advisories across vendors and distributi...

CVE-2021-36374

CVE-2021-36374 affects Apache Ant and causes denial of service via memory allocation when parsing specially crafted ZIP-based archives (and derived formats such as JARs and certain Office files). The vulnerability stems from how Ant reads these archives, enabling large memory use and out-of-memor...

CVE-2019-17569

CVE-2019-17569: In Apache Tomcat, a regression from refactoring in 9.0.28–9.0.30, 8.5.48–8.5.50, and 7.0.98–7.0.99 caused invalid Transfer-Encoding header handling, enabling HTTP Request Smuggling behind a misconfigured reverse proxy. Connected advisories show mitigations: Amazon Linux 2 ALAS2TOM...

CVE-2021-42340

The CVE-2021-42340 issue is a memory leak in Apache Tomcat caused by the upgrade HTTP metric collector not releasing WebSocket resources after close. Affected versions include Tomcat 8.5.60–8.5.71, 9.0.40–9.0.53, 10.0.0-M1–10.0.11, and 10.1.0-M1–10.1.0-M5. Over time, this leak can lead to OutOfMe...

CVE-2022-23181

CVE-2022-23181 is a TOCTTOU vulnerability introduced by the fix for CVE-2020-9484 in Apache Tomcat when the server persists sessions using FileStore. It is exploitable by a local attacker who can perform actions with the Tomcat process user privileges. Affected ranges (per the sources) include To...

CVE-2020-1945

This CVE (CVE-2020-1945) affects Apache Ant. Connected Arch Linux advisory ASA-202005-15 confirms the vulnerability exists in ant before version 1.10.8-1, where Ant uses java.io.tmpdir for several tasks and can leak sensitive information. The fixcrlf and replaceregexp tasks may copy files from th...

CVE-2022-23437

Technical specifics for CVE-2022-23437 (Xerces-J infinite loop in XML parsing) are not disclosed in the provided connected documents. Monitor for vendor/maintainer updates; current entries reference the issue but do not provide detailed root-cause, affected versions beyond 2.12.1, or fixes.

CVE-2020-17521

CVE-2020-17521 affects Apache Groovy extension methods that handle temporary directory creation. The root cause is a race condition in Groovy’s implementation, which previously called a now-superseded Java JDK method; this could allow a local attacker to obtain sensitive information. Affected ver...

CVE-2019-10219

The CVE-2019-10219 entry affects Hibernate Validator: SafeHtml validator annotation fails to sanitize HTML comments/instructions, enabling XSS in affected code paths. Affected CP4S versions are 1.7.2.0, 1.8.0.0, and 1.8.1.0. Remediation is to upgrade to Cloud Pak for Security 1.9.0.0 per IBM guid...

CVE-2020-11979

CVE-2020-11979 affects Apache Ant 1.10.8. The mitigation for CVE-2020-1945 changed temp-file permissions, but the fixcrlf task deleted the temp file and recreated it without protection, enabling an attacker to inject modified source files during builds. Connected advisories confirm the issue and ...

CVE-2019-0227

The CVE-2019-0227 entry concerns an SSRF in Apache Axis 1.4 (last released in 2006). The connected IBM bulletins confirm Axis 1.x vulnerability details and state Axis 2 is the successor, with 1.7.9 (Axis2) being not vulnerable. Affected Axis 1.x components are legacy; remediation is to upgrade to...

CVE-2020-11987

CVE-2020-11987 – SSRF in Apache Batik 1.13 . The initial description confirms a server-side request forgery via improper input validation in NodePickerPanel, enabling an attacker to make arbitrary GET requests from the server. Connected documents corroborate concrete remediation actions across ve...

CVE-2021-2351

CVE-2021-2351 affects Oracle Database Server’s Advanced Networking Option, with affected versions 12.1.0.2, 12.2.0.1, and 19c. The vulnerability allows unauthenticated network access via Oracle Net to compromise the Advanced Networking Option, with access requiring user interaction (UI_R) and ris...

CVE-2018-8032

CVE-2018-8032 affects Apache Axis 1.x (up to 1.4) with a cross-site scripting (XSS) vulnerability in the default servlet/services. This vulnerability is documented in IBM/PM security bulletins linked to Axis, confirming an XSS flaw (CWE-79) in Axis 1.x and indicating broader IBM product exposure....

CVE-2017-3730

OpenSSL 1.1.0 before 1.1.0d is affected. A malicious server may supply bad DHE/ECDHE parameters causing the client to dereference a NULL pointer, resulting in a client crash and a Denial of Service. This is the explicit root cause described in multiple sources. Remediation is to upgrade to OpenSS...

CVE-2021-1996

CVE-2021-1996 affects Oracle WebLogic Server (Oracle Fusion Middleware, Web Services component). Affected versions include 10.3.6.0.0 and 12.1.3.0.0. The issue allows a high-privilege attacker with network access via HTTP to compromise the server, with human interaction required and potential una...

CVE-2016-0497

CVE-2016-0497 concerns an unspecified vulnerability in the Oracle Agile Engineering Data Management Web Client component of Oracle Supply Chain Products Suite, affecting versions 6.1.2.2, 6.1.3.0, and 6.2.0.0. The impact is to integrity via unknown vectors related to the Web Client, with remote a...

CVE-2017-10161

CVE-2017-10161 affects Oracle Engineering Data Management in the Oracle Supply Chain Products Suite (Web Services Security). Affected versions are 6.1.3.0 and 6.2.2.0. The vulnerability can be exploited by an unauthenticated attacker over HTTP to perform unauthorized update, insert, or delete ope...

CVE-2016-3428

CVE-2016-3428 is associated with Oracle Agile Engineering Data Management in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0, where an unspecified vulnerability could allow remote attackers to affect availability through the Engineering Communication Interface. The connected records confir...

CVE-2016-3468

CVE-2016-3468 affects Oracle Supply Chain Products Suite, specifically the Oracle Agile Engineering Data Management component in versions 6.1.3.0 and 6.2.0.0. The vulnerability is described as an unspecified issue in the Install subcomponent that could impact confidentiality, integrity, and avail...

CVE-2016-0498

CVE-2016-0498 concerns the Oracle Agile Engineering Data Management Install component within Oracle Supply Chain Products Suite versions 6.1.2.2, 6.1.3.0, and 6.2.0.0. The vulnerability is described as an unspecified issue allowing confidentiality impact related to the Install process. NVD cites ...

CVE-2016-5518

CVE-2016-5518: Unspecified vulnerability in Oracle Agile Engineering Data Management (Oracle Supply Chain Products Suite) versions 6.1.3.0 and 6.2.0.0, specifically in the webfileservices subcomponent. Remote attackers could impact confidentiality, integrity, and availability. Documented impact i...

CVE-2026-61186

Technical details (affected product/version, root cause, impact, remediation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-61187

The CVE-2026-61187 entry concerns Oracle Agile Engineering Data Management (Oracle Supply Chain) with the Install component affected in version 6.2.1. The vulnerability is described as exploitable locally via the Install component, requiring a user who is logged into the infrastructure and perfor...

CVE-2026-61189

CVE-2026-61189 concerns Oracle Agile Engineering Data Management (Oracle Supply Chain), specifically the Install component in version 6.2.1. The vulnerability allows a low-privilege user with login access to the infrastructure where Oracle Agile Engineering Data Management runs to compromise the ...

CVE-2026-61194

Oracle Agile Engineering Data Management (Supply Chain, Core) is affected in version 6.2.1. The flaw allows a low-privileged, network-accessible attacker (TCP) to trigger a hang or frequent crash (DoS). CVSS 3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation details are not pr...

CVE-2026-71052

Oracle Agile Engineering Data Management (Supply Chain), version 6.2.1, has a HIGH-severity flaw in the Web Services Security component. A low-privileged attacker with network HTTP access can fully compromise the application (C/I/A all HIGH), CVSS 8.8. Oracle's August 2026 CPU advisory is referen...

CVE-2026-61190

CVE-2026-61190 affects Oracle Agile Engineering Data Management (Oracle Supply Chain), specifically the Install component, version 6.2.1. The vulnerability allows a low-privilege attacker who has network access via HTTP to compromise the system. Successful exploitation requires user interaction a...

CVE-2026-61192

The CVE-2026-61192 entry concerns Oracle Agile Engineering Data Management (Oracle Supply Chain), specifically the Install component in version 6.2.1. The issue is exploitable by a low-privilege attacker with network access over HTTP, potentially causing a hang or frequent crash (complete DOS). T...

CVE-2026-61191

The CVE-2026-61191 entry pertains to Oracle Agile Engineering Data Management (Oracle Supply Chain), specifically the Document Management component in version 6.2.1. The vulnerability is characterized as easily exploitable with local access (low privileges, user login required) and can lead to un...

CVE-2026-61195

CVE-2026-61195 affects Oracle Agile Engineering Data Management (Oracle Supply Chain), Core component, version 6.2.1. The vulnerability enables a low-privilege, unauthenticated attacker with network access over TCP to cause a hang or frequent crashes (DoS) in the affected product. The CVSS 3.1 ba...

CVE-2026-70691

Oracle Agile Engineering Data Management 6.2.1's Engineering Communication Interface has a HIGH-severity (CVSS 7.5) flaw: an unauthenticated attacker with physical access to the communication segment can fully compromise the application (C/I/A impacts). No patch version is specified; Oracle's Aug...

CVE-2026-70697

CVE-2026-70697 affects Oracle Agile Engineering Data Management 6.2.1, specifically the Engineering Communication Interface component. A low-privileged attacker with local access can exploit this HIGH-severity (CVSS 7.0) flaw to fully compromise the application. Oracle's August 2026 security advi...

CVE-2026-71053

CVE-2026-71053 affects Oracle Agile Engineering Data Management (Oracle Supply Chain), specifically the Web Services Security component in version 6.2.1 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to achieve full takeover of the product, resulting in ...

CVE-2026-70698

Oracle Agile Engineering Data Management 6.2.1 (Install component) is vulnerable to local privilege escalation by a high-privileged attacker, enabling full product takeover. CVSS 3.1 base score 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No exploitation details provided; Oracle security advisory r...

CVE-2026-70693

Oracle Agile Engineering Data Management (version 6.2.1) component Engineering Communication Interface has a local, high-complexity vulnerability requiring high privileges and human interaction; successful exploitation yields full system takeover (CVSS 6.3 MEDIUM). No exploit code or patch detail...