Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,130

Export CSV
CVE-2016-6794

tomcat: system property disclosure

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

CVSS 3.1 · 5.3 Medium EPSS 7.2% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 12 more
CVE-2016-5388

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.0 · 8.1 High EPSS 50.9% KEV · Not listed
Vendors
Apache Hp Oracle and 1 more
Products
Tomcat System Management Homepage Linux and 10 more
CVE-2016-1182

struts: Improper input validation in Validator

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

CVSS 3.0 · 8.2 High EPSS 25.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-1181

struts: Vulnerability in ActionForm allows unintended remote operations against components on server memory

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

CVSS 3.0 · 8.1 High EPSS 12.7% KEV · Not listed
Vendors
Apache Oracle
Products
Struts Banking Platform Portal
CVE-2016-0763

tomcat: security manager bypass via setGlobalContext()

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

CVSS 3.0 · 6.3 Medium EPSS 11.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 2 more
CVE-2016-0714

tomcat: Security Manager bypass via persistence mechanisms

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

CVSS 3.0 · 8.8 High EPSS 13.1% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 2 more
CVE-2016-0706

tomcat: security manager bypass via StatusManagerServlet

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

CVSS 3.0 · 4.3 Medium EPSS 6.1% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 2 more
CVE-2015-5351

tomcat: CSRF token leak

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

CVSS 3.0 · 8.8 High EPSS 9.7% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 2 more
CVE-2015-5346

tomcat: Session fixation

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

CVSS 3.0 · 8.1 High EPSS 10.6% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 2 more
CVE-2015-5345

tomcat: directory disclosure

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

CVSS 3.1 · 5.3 Medium EPSS 18.4% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 2 more
CVE-2015-5174

tomcat: URL Normalization issue

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

CVSS 3.0 · 4.3 Medium EPSS 12.6% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 3 more
CVE-2015-0254

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

CVSS 3.0 · 7.6 High EPSS 12.0% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Standard Taglibs Ubuntu Linux Enterprise Linux and 2 more
CVE-2014-7810

Tomcat/JbossWeb: security manager bypass via EL expressions

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

CVSS 2.0 · 5.0 Medium EPSS 13.3% KEV · Not listed
Vendors
Apache Debian Hp and 1 more
Products
Tomcat Debian Linux Hp-ux and 2 more
CVE-2014-0230

tomcat: non-persistent DoS attack by feeding data by aborting an upload

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.

CVSS 2.0 · 7.8 High EPSS 20.2% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Tomcat Virtualization Enterprise Linux and 2 more
CVE-2014-0227

Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

CVSS 2.0 · 6.4 Medium EPSS 21.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 8 more
CVE-2014-0119

Tomcat/JBossWeb: XML parser hijack by malicious web application

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CVSS 2.0 · 4.3 Medium EPSS 7.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 7 more
CVE-2014-0114

1: Class Loader manipulation via request parameters

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

CVSS 2.0 · 7.5 High EPSS 99.0% KEV · Not listed
Vendors
Apache Redhat
Products
Commons Beanutils Struts Amq Broker and 5 more
CVE-2014-0099

Tomcat/JBossWeb: Request smuggling via malicious content length header

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CVSS 2.0 · 4.3 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 8 more
CVE-2014-0096

Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 4.3 Medium EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 7 more
CVE-2014-0075

Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CVSS 2.0 · 5.0 Medium EPSS 17.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Bpms and 8 more