Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/599529?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/599529?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.1", "type": "maven", "namespace": "org.apache.tomcat.embed", "name": "tomcat-embed-core", "version": "11.0.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "11.0.9", "latest_non_vulnerable_version": "11.0.21", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4422?format=api", "vulnerability_id": "VCID-fpgj-82wf-ykbw", "summary": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53506.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-53506.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53506", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00324", "scoring_system": "epss", "scoring_elements": "0.5542", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00324", "scoring_system": "epss", "scoring_elements": "0.55445", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.6251", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.6252", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62478", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.625", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62511", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62492", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62476", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62425", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00429", "scoring_system": "epss", "scoring_elements": "0.62527", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00446", "scoring_system": "epss", "scoring_elements": "0.63498", "published_at": "2026-04-26T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53506" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/2aa6261276ebe50b99276953591e3a2be7898bdb" }, { "reference_url": "https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/434772930f362145516dd60681134e7f0cf8115b" }, { "reference_url": "https://github.com/apache/tomcat/commit/be8f330f83ceddaf3baeed57522e571572b6b99b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/be8f330f83ceddaf3baeed57522e571572b6b99b" }, { "reference_url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-11T13:46:01Z/" } ], "url": "https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/07/10/13", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/07/10/13" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109113", "reference_id": "1109113", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109113" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109114", "reference_id": "1109114", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109114" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386", "reference_id": "2379386", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379386" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506", "reference_id": "CVE-2025-53506", "reference_type": "", "scores": [ { "value": "Important", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" }, { "reference_url": "https://github.com/advisories/GHSA-25xr-qj8w-c4vf", "reference_id": "GHSA-25xr-qj8w-c4vf", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-25xr-qj8w-c4vf" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11695", "reference_id": "RHSA-2025:11695", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11695" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11696", "reference_id": "RHSA-2025:11696", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11696" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11741", "reference_id": "RHSA-2025:11741", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11741" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11742", "reference_id": "RHSA-2025:11742", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11742" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14177", "reference_id": "RHSA-2025:14177", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14177" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14178", "reference_id": "RHSA-2025:14178", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14178" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14179", "reference_id": "RHSA-2025:14179", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14179" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14180", "reference_id": "RHSA-2025:14180", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14180" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14181", "reference_id": "RHSA-2025:14181", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14181" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14182", "reference_id": "RHSA-2025:14182", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14182" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:14183", "reference_id": "RHSA-2025:14183", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:14183" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/70498?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.9", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.9" } ], "aliases": [ "CVE-2025-53506", "GHSA-25xr-qj8w-c4vf" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fpgj-82wf-ykbw" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4448?format=api", "vulnerability_id": "VCID-xgr8-tpv5-q3b2", "summary": "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28709.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28709.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28709", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59593", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.5965", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59629", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.5966", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59677", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59669", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59636", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59655", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59672", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59652", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59639", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59618", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00383", "scoring_system": "epss", "scoring_elements": "0.59588", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28709" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/5badf94e79e5de206fc0ef3054fd536b1bb787cd", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/5badf94e79e5de206fc0ef3054fd536b1bb787cd" }, { "reference_url": "https://github.com/apache/tomcat/commit/ba848da71c523d94950d3c53c19ea155189df9dc", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/ba848da71c523d94950d3c53c19ea155189df9dc" }, { "reference_url": "https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38" }, { "reference_url": "https://github.com/apache/tomcat/commit/fbd81421629afe8b8a3922d59020cde81caea861", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/tomcat/commit/fbd81421629afe8b8a3922d59020cde81caea861" }, { "reference_url": "https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:15:57Z/" } ], "url": "https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j" }, { "reference_url": "https://security.gentoo.org/glsa/202305-37", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:15:57Z/" } ], "url": "https://security.gentoo.org/glsa/202305-37" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230616-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20230616-0004" }, { "reference_url": "https://tomcat.apache.org/security-10.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-10.html" }, { "reference_url": "https://tomcat.apache.org/security-11.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-11.html" }, { "reference_url": "https://tomcat.apache.org/security-8.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-8.html" }, { "reference_url": "https://tomcat.apache.org/security-9.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://tomcat.apache.org/security-9.html" }, { "reference_url": "https://www.debian.org/security/2023/dsa-5521", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:15:57Z/" } ], "url": "https://www.debian.org/security/2023/dsa-5521" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2023/05/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:15:57Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2023/05/22/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2210321", "reference_id": "2210321", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2210321" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28709", "reference_id": "CVE-2023-28709", "reference_type": "", "scores": [ { "value": "Moderate", "scoring_system": "apache_tomcat", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28709" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28709", "reference_id": "CVE-2023-28709", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28709" }, { "reference_url": "https://github.com/advisories/GHSA-cx6h-86xw-9x34", "reference_id": "GHSA-cx6h-86xw-9x34", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cx6h-86xw-9x34" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230616-0004/", "reference_id": "ntap-20230616-0004", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:15:57Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20230616-0004/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:4909", "reference_id": "RHSA-2023:4909", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:4909" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:4910", "reference_id": "RHSA-2023:4910", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:4910" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:6570", "reference_id": "RHSA-2023:6570", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:6570" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:7065", "reference_id": "RHSA-2023:7065", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:7065" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56008?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.88", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5732-xnx7-tkfy" }, { "vulnerability": "VCID-6kcx-vptm-zbds" }, { "vulnerability": "VCID-fpgj-82wf-ykbw" }, { "vulnerability": "VCID-j6cj-ftyd-3ffa" }, { "vulnerability": "VCID-vsdf-4tfj-uybe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.88" }, { "url": "http://public2.vulnerablecode.io/api/packages/57651?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.74", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5732-xnx7-tkfy" }, { "vulnerability": "VCID-6kcx-vptm-zbds" }, { "vulnerability": "VCID-fpgj-82wf-ykbw" }, { "vulnerability": "VCID-j6cj-ftyd-3ffa" }, { "vulnerability": "VCID-vsdf-4tfj-uybe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.74" }, { "url": "http://public2.vulnerablecode.io/api/packages/57652?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5732-xnx7-tkfy" }, { "vulnerability": "VCID-fpgj-82wf-ykbw" }, { "vulnerability": "VCID-j6cj-ftyd-3ffa" }, { "vulnerability": "VCID-vsdf-4tfj-uybe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/56007?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.0-M5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5732-xnx7-tkfy" }, { "vulnerability": "VCID-fpgj-82wf-ykbw" }, { "vulnerability": "VCID-j6cj-ftyd-3ffa" }, { "vulnerability": "VCID-v7tp-1t4h-zqeg" }, { "vulnerability": "VCID-vsdf-4tfj-uybe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.0-M5" }, { "url": "http://public2.vulnerablecode.io/api/packages/599529?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-fpgj-82wf-ykbw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.1" } ], "aliases": [ "CVE-2023-28709", "GHSA-cx6h-86xw-9x34" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xgr8-tpv5-q3b2" } ], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.1" }