Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2017-12617

tomcat: Remote Code Execution bypass for CVE-2017-12615

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1 · 8.1 High EPSS 100.0% KEV · Listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 57 more
CVE-2020-9488

log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

CVSS 3.1 · 3.7 Low EPSS 8.2% KEV · Not listed
Vendors
Apache Debian Oracle and 2 more
Products
Log4j Debian Linux Communications Application Session Controller and 50 more