VulnerableCode Package Details - pkg:apache/tomcat@7.0.0

Vulnerabilities affecting this package (68)

Vulnerability	Summary	Fixed by
VCID-18q4-zark-s7a7 Aliases: CVE-2016-6794 GHSA-2rvf-329f-p99g	When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.	7.0.72 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.37 Affected by 0 other vulnerabilities. 8.5.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M10 Affected by 0 other vulnerabilities.
VCID-1k8f-vsg1-k3d6 Aliases: CVE-2016-0706 GHSA-6vx3-hr43-cfrh	Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.	7.0.68 Affected by 0 other vulnerabilities. 8.0.32 Affected by 0 other vulnerabilities. 9.0.0+M3 Affected by 0 other vulnerabilities.
VCID-241m-q6vd-kudk Aliases: CVE-2011-2526 GHSA-9ggm-7897-x4mg	Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.	7.0.19 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-2sbh-sy57-3uez Aliases: CVE-2018-1304 GHSA-6rxj-58jh-436r	The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.	7.0.85 Affected by 0 other vulnerabilities. 8.0.50 Affected by 0 other vulnerabilities. 8.5.28 Affected by 0 other vulnerabilities. 9.0.5 Affected by 0 other vulnerabilities.
VCID-3cr9-g81m-4ugy Aliases: CVE-2016-5018 GHSA-4v3g-g84w-hv7r	In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.	7.0.72 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.37 Affected by 0 other vulnerabilities. 8.5.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M10 Affected by 0 other vulnerabilities.
VCID-3n4t-bvb1-5qer Aliases: CVE-2016-6796 GHSA-3mjp-p938-4329	A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.	7.0.72 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.37 Affected by 0 other vulnerabilities. 8.5.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M10 Affected by 0 other vulnerabilities.
VCID-3r3s-q21j-c3au Aliases: CVE-2016-6816 GHSA-jc7p-5r39-9477	The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.	7.0.73 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.39 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-4aaa-errb-2qdw Aliases: CVE-2019-0232 GHSA-8vmx-qmch-mpqg	When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).	7.0.94 Affected by 0 other vulnerabilities. 8.5.40 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.19 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-4mkw-7haq-pkgn Aliases: CVE-2014-0230 GHSA-pxcx-cxq8-4mmw	Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.	7.0.55 Affected by 0 other vulnerabilities. 8.0.9 Affected by 0 other vulnerabilities.
VCID-5eqm-218u-p7gq Aliases: CVE-2011-1475 GHSA-h6c8-rg87-f3pc	The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."	7.0.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-618c-ar98-qfcr Aliases: CVE-2011-2729	native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.	7.0.20 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-66kh-s6cr-tqf9 Aliases: CVE-2020-9484 GHSA-344f-f5vg-2jfj	When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.	7.0.104 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 7.0.108 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.55 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.5.63 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.35 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.43 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.0.0-M5 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.0.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-68fk-4g86-ekbp Aliases: CVE-2015-5345 GHSA-rh8q-vjgf-gf74	The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.	7.0.68 Affected by 0 other vulnerabilities. 8.0.30 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M3 Affected by 0 other vulnerabilities.
VCID-7cpu-h5fr-8ffd Aliases: CVE-2014-7810 GHSA-4c43-cwvx-9crh	The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.	7.0.59 Affected by 0 other vulnerabilities. 8.0.17 Affected by 0 other vulnerabilities.
VCID-7ej8-5f77-cybb Aliases: CVE-2011-0534 GHSA-43v2-6grp-9pp9	Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.	7.0.8 Affected by 0 other vulnerabilities.
VCID-886n-1vzv-syc6 Aliases: CVE-2010-4172 GHSA-c78g-qwpw-2jgv	Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.	7.0.5 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-95d1-arxd-hkd1 Aliases: CVE-2016-8735 GHSA-cw54-59pw-4g8c	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.	7.0.73 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.39 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-95fn-d2ad-qyg6 Aliases: CVE-2011-1088 GHSA-mg4v-rf8p-ghqq	Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.	7.0.11 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-9exq-fhv6-bbea Aliases: CVE-2016-0763 GHSA-9hjv-9h75-xmpp	The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.	7.0.68 Affected by 0 other vulnerabilities. 8.0.32 Affected by 0 other vulnerabilities. 9.0.0+M3 Affected by 0 other vulnerabilities.
VCID-a1by-zvtm-akdc Aliases: CVE-2014-0227 GHSA-42j3-498q-m6vp	java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.	7.0.55 Affected by 0 other vulnerabilities. 8.0.9 Affected by 0 other vulnerabilities.
VCID-a8gk-n8bq-87cp Aliases: CVE-2021-24122 GHSA-2rvv-w9r2-rg7m	When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.	7.0.107 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.5.60 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.40 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.0.0-M10 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-afm2-uj45-xkgx Aliases: CVE-2013-2071 GHSA-3p5r-7cw3-2m67	java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.	7.0.40 Affected by 0 other vulnerabilities.
VCID-arkn-bca7-hqam Aliases: CVE-2019-0221 GHSA-jjpq-gp5q-8q6w	The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.	7.0.94 Affected by 0 other vulnerabilities. 8.5.40 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.19 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-c4jv-ws83-x7g2 Aliases: CVE-2017-12616 GHSA-8qq4-8jvq-mfw4	When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.	7.0.81 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-d9ys-kxh6-nkgr Aliases: CVE-2011-1184 GHSA-q9xf-jwr4-v445	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.	7.0.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-dhun-hj5q-dfch Aliases: CVE-2011-0013 GHSA-3p86-xgrq-m6p6	Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.	7.0.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-dzpn-w4b3-vbcm Aliases: CVE-2019-17563 GHSA-9xcj-c8cr-8c3c	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.	7.0.99 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.5.50 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.30 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-e2kr-7pmg-gfc9 Aliases: CVE-2013-4444 GHSA-h6c8-x5r3-pm88	Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.	7.0.40 Affected by 0 other vulnerabilities.
VCID-eb37-mkxf-7fgw Aliases: CVE-2020-1938 GHSA-c9hw-wf7x-jp9j	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.	7.0.100 Affected by 0 other vulnerabilities. 8.5.51 Affected by 0 other vulnerabilities. 9.0.31 Affected by 0 other vulnerabilities.
VCID-f2zy-gq57-ufat Aliases: CVE-2010-2227 GHSA-cxg2-49rq-8gcr	Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."	7.0.2 Affected by 0 other vulnerabilities.
VCID-fpuc-fe6m-47c6 Aliases: CVE-2012-3546 GHSA-jgm2-m5cg-f66g	org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.	7.0.30 Affected by 0 other vulnerabilities.
VCID-fyfz-6tr5-2fc7 Aliases: CVE-2017-5664 GHSA-jmvv-524f-hj5j	The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.	7.0.78 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.44 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.15 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M21 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-g7bk-891a-uufy Aliases: CVE-2018-1305 GHSA-jx6h-3fjx-cgv5	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.	7.0.85 Affected by 0 other vulnerabilities. 8.0.50 Affected by 0 other vulnerabilities. 8.5.28 Affected by 0 other vulnerabilities. 9.0.5 Affected by 0 other vulnerabilities.
VCID-gv12-4ruf-kfhq Aliases: CVE-2014-0050 GHSA-xx68-jfcg-xmmf	MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.	7.0.52 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.3 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-h9ds-trhx-m7aj Aliases: CVE-2013-4286 GHSA-j448-j653-r3vj	Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.	7.0.47 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.0-RC3 Affected by 0 other vulnerabilities.
VCID-hhk9-cr54-8fgc Aliases: CVE-2012-0022 GHSA-8h2q-qm9x-55jc	Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.	7.0.23 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-hmbm-5ysw-77bu Aliases: CVE-2017-5648 GHSA-3vx3-xf6q-r5xp	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.	7.0.76 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.42 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.12 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M18 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-hves-r5bg-yfes Aliases: CVE-2016-8745 GHSA-w3j5-q8f2-3cqq	A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.	7.0.75 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.41 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.9 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M15 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-hxj6-mupf-abbc Aliases: CVE-2011-3375 GHSA-rp8h-vr48-4j8p	Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.	7.0.22 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-j2j9-avuw-n3eq Aliases: CVE-2011-3376	org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.	7.0.22 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-jf7u-dvpd-b7f4 Aliases: CVE-2014-0119 GHSA-prc3-7f44-w48j	Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.	7.0.54 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.8 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-kagr-74d9-kyhx Aliases: CVE-2016-0762 GHSA-wxcp-f2c8-x6xv	The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.	7.0.72 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.37 Affected by 0 other vulnerabilities. 8.5.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M10 Affected by 0 other vulnerabilities.
VCID-kgd1-bzst-muh7 Aliases: CVE-2014-0096 GHSA-qprx-q2r7-3rx6	java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.	7.0.53 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-kwab-3s4q-eka4 Aliases: CVE-2021-30640 GHSA-36qh-35cm-5w2w	A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.	7.0.109 Affected by 0 other vulnerabilities. 8.5.66 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.46 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.0.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-kzzv-rhya-j7dd Aliases: CVE-2014-0075 GHSA-475f-74wp-pqv5	Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.	7.0.53 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-m1zd-uytj-3bej Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm	A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	7.0.77 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.43 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.13 Affected by 0 other vulnerabilities. 9.0.0+M19 Affected by 0 other vulnerabilities.
VCID-mctd-9zgv-5qgp Aliases: CVE-2011-2204 GHSA-c57p-3v2g-w9rg	Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.	7.0.19 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-mwk8-b5c9-kbb9 Aliases: CVE-2012-4534	org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.	7.0.28 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-n3ab-nk7c-hqc9 Aliases: CVE-2021-25329 GHSA-jgwr-3qm3-26f3	The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.	7.0.108 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.63 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 9.0.43 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.0.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-n76n-ywja-rbhh Aliases: CVE-2012-3439	Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5885, CVE-2012-5886, CVE-2012-5887. Reason: This candidate is a duplicate of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887. Notes: All CVE users should reference one or more of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.	7.0.30 Affected by 0 other vulnerabilities.
VCID-p4dn-y54m-8fd1 Aliases: CVE-2012-3544 GHSA-qfxv-3ppc-7qg5	Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.	7.0.30 Affected by 0 other vulnerabilities.
VCID-p6ch-pc73-b3ck Aliases: CVE-2015-5174 GHSA-6qr6-x7jm-x2q6	Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.	7.0.65 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.27 Affected by 0 other vulnerabilities.
VCID-pqxe-tfhk-47b7 Aliases: CVE-2016-3092 GHSA-fvm3-cfvj-gxqq	The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.	7.0.70 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.36 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.5.3 Affected by 0 other vulnerabilities. 9.0.0+M8 Affected by 0 other vulnerabilities.
VCID-q6hm-mmfs-zka5 Aliases: CVE-2017-12615 GHSA-pjfr-qf3p-3q25	When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.	7.0.81 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-quwu-ep21-cyew Aliases: CVE-2011-3190 GHSA-c38m-v4m2-524v	Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.	7.0.21 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ruuh-g3fa-m7d8 Aliases: CVE-2019-12418 GHSA-hh3j-x4mc-g48r	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.	7.0.99 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.5.49 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.29 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-ryha-ndms-afbn Aliases: CVE-2013-2067 GHSA-6m48-jxwx-76q7	java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.	7.0.33 Affected by 0 other vulnerabilities.
VCID-ta1m-dh8x-nubc Aliases: CVE-2012-4431 GHSA-76vr-72mv-mf3q	org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.	7.0.32 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-tcbc-3kgt-muam Aliases: CVE-2013-4322 GHSA-wq2p-q66w-q8gp	Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.	7.0.50 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.0-RC10 Affected by 0 other vulnerabilities.
VCID-tfn5-6ckq-wyce Aliases: CVE-2010-3718 GHSA-fj6c-prgj-gr3r	Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.	7.0.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-tfrs-d458-tfaq Aliases: CVE-2016-0714 GHSA-mv42-px54-87jw	The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.	7.0.68 Affected by 0 other vulnerabilities. 8.0.32 Affected by 0 other vulnerabilities. 9.0.0+M3 Affected by 0 other vulnerabilities.
VCID-vd1s-m27a-8ucc Aliases: CVE-2012-2733	java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.	7.0.28 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-vdnj-sqmx-e3ep Aliases: CVE-2017-12617 GHSA-xjgh-84hx-56c5	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.	7.0.82 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.47 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.5.23 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-w82a-7kk2-p3f1 Aliases: CVE-2013-4590 GHSA-87w9-x2c3-hrjj	Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.	7.0.50 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.0-RC10 Affected by 0 other vulnerabilities.
VCID-xf8r-kqxb-7qdy Aliases: CVE-2016-6797 GHSA-q6x7-f33r-3wxx	The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.	7.0.72 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 8.0.37 Affected by 0 other vulnerabilities. 8.5.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M10 Affected by 0 other vulnerabilities.
VCID-xqrn-wuv5-x7de Aliases: CVE-2011-2481 GHSA-r7c8-hghc-2mp8	Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.	7.0.19 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-yfx4-4gsc-2kgh Aliases: CVE-2020-1935 GHSA-qxf4-chvg-4r8r	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.	7.0.100 Affected by 0 other vulnerabilities. 8.5.51 Affected by 0 other vulnerabilities. 9.0.31 Affected by 0 other vulnerabilities.
VCID-ygvw-69am-s7ae Aliases: CVE-2014-0099 GHSA-xh5x-j8jf-pcpx	Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.	7.0.53 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Next non-vulnerable version	7.0.2
Latest non-vulnerable version	11.0.21
Risk	10.0

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:15.928689+00:00	Apache Tomcat Importer	Affected by	VCID-f2zy-gq57-ufat	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.893818+00:00	Apache Tomcat Importer	Affected by	VCID-tfn5-6ckq-wyce	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.862271+00:00	Apache Tomcat Importer	Affected by	VCID-886n-1vzv-syc6	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.831389+00:00	Apache Tomcat Importer	Affected by	VCID-dhun-hj5q-dfch	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.797566+00:00	Apache Tomcat Importer	Affected by	VCID-7ej8-5f77-cybb	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.761055+00:00	Apache Tomcat Importer	Affected by	VCID-95fn-d2ad-qyg6	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.701113+00:00	Apache Tomcat Importer	Affected by	VCID-d9ys-kxh6-nkgr	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.666897+00:00	Apache Tomcat Importer	Affected by	VCID-5eqm-218u-p7gq	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.600645+00:00	Apache Tomcat Importer	Affected by	VCID-xqrn-wuv5-x7de	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.572218+00:00	Apache Tomcat Importer	Affected by	VCID-mctd-9zgv-5qgp	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.538978+00:00	Apache Tomcat Importer	Affected by	VCID-241m-q6vd-kudk	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.505833+00:00	Apache Tomcat Importer	Affected by	VCID-618c-ar98-qfcr	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.477730+00:00	Apache Tomcat Importer	Affected by	VCID-quwu-ep21-cyew	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.445518+00:00	Apache Tomcat Importer	Affected by	VCID-j2j9-avuw-n3eq	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.412909+00:00	Apache Tomcat Importer	Affected by	VCID-hxj6-mupf-abbc	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.372445+00:00	Apache Tomcat Importer	Affected by	VCID-hhk9-cr54-8fgc	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.324244+00:00	Apache Tomcat Importer	Affected by	VCID-mwk8-b5c9-kbb9	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.291020+00:00	Apache Tomcat Importer	Affected by	VCID-vd1s-m27a-8ucc	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.262715+00:00	Apache Tomcat Importer	Affected by	VCID-fpuc-fe6m-47c6	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.233431+00:00	Apache Tomcat Importer	Affected by	VCID-n76n-ywja-rbhh	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.198769+00:00	Apache Tomcat Importer	Affected by	VCID-p4dn-y54m-8fd1	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.166938+00:00	Apache Tomcat Importer	Affected by	VCID-ta1m-dh8x-nubc	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.133539+00:00	Apache Tomcat Importer	Affected by	VCID-ryha-ndms-afbn	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.101857+00:00	Apache Tomcat Importer	Affected by	VCID-e2kr-7pmg-gfc9	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.067042+00:00	Apache Tomcat Importer	Affected by	VCID-afm2-uj45-xkgx	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.035769+00:00	Apache Tomcat Importer	Affected by	VCID-h9ds-trhx-m7aj	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.007575+00:00	Apache Tomcat Importer	Affected by	VCID-w82a-7kk2-p3f1	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.976592+00:00	Apache Tomcat Importer	Affected by	VCID-tcbc-3kgt-muam	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.945408+00:00	Apache Tomcat Importer	Affected by	VCID-gv12-4ruf-kfhq	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.917683+00:00	Apache Tomcat Importer	Affected by	VCID-ygvw-69am-s7ae	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.886409+00:00	Apache Tomcat Importer	Affected by	VCID-kgd1-bzst-muh7	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.849627+00:00	Apache Tomcat Importer	Affected by	VCID-kzzv-rhya-j7dd	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.815061+00:00	Apache Tomcat Importer	Affected by	VCID-jf7u-dvpd-b7f4	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.778212+00:00	Apache Tomcat Importer	Affected by	VCID-4mkw-7haq-pkgn	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.742864+00:00	Apache Tomcat Importer	Affected by	VCID-a1by-zvtm-akdc	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.710020+00:00	Apache Tomcat Importer	Affected by	VCID-7cpu-h5fr-8ffd	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.678706+00:00	Apache Tomcat Importer	Affected by	VCID-p6ch-pc73-b3ck	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.617032+00:00	Apache Tomcat Importer	Affected by	VCID-9exq-fhv6-bbea	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.584957+00:00	Apache Tomcat Importer	Affected by	VCID-tfrs-d458-tfaq	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.553762+00:00	Apache Tomcat Importer	Affected by	VCID-1k8f-vsg1-k3d6	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.489585+00:00	Apache Tomcat Importer	Affected by	VCID-68fk-4g86-ekbp	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.456655+00:00	Apache Tomcat Importer	Affected by	VCID-pqxe-tfhk-47b7	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.426607+00:00	Apache Tomcat Importer	Affected by	VCID-kagr-74d9-kyhx	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.395289+00:00	Apache Tomcat Importer	Affected by	VCID-3cr9-g81m-4ugy	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.365690+00:00	Apache Tomcat Importer	Affected by	VCID-18q4-zark-s7a7	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.335572+00:00	Apache Tomcat Importer	Affected by	VCID-3n4t-bvb1-5qer	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.308603+00:00	Apache Tomcat Importer	Affected by	VCID-xf8r-kqxb-7qdy	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.282985+00:00	Apache Tomcat Importer	Affected by	VCID-3r3s-q21j-c3au	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.251151+00:00	Apache Tomcat Importer	Affected by	VCID-95d1-arxd-hkd1	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.220126+00:00	Apache Tomcat Importer	Affected by	VCID-hves-r5bg-yfes	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.188955+00:00	Apache Tomcat Importer	Affected by	VCID-hmbm-5ysw-77bu	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.161398+00:00	Apache Tomcat Importer	Affected by	VCID-m1zd-uytj-3bej	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.129526+00:00	Apache Tomcat Importer	Affected by	VCID-fyfz-6tr5-2fc7	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.069165+00:00	Apache Tomcat Importer	Affected by	VCID-q6hm-mmfs-zka5	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.040033+00:00	Apache Tomcat Importer	Affected by	VCID-c4jv-ws83-x7g2	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.004060+00:00	Apache Tomcat Importer	Affected by	VCID-vdnj-sqmx-e3ep	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.940025+00:00	Apache Tomcat Importer	Affected by	VCID-2sbh-sy57-3uez	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.909604+00:00	Apache Tomcat Importer	Affected by	VCID-g7bk-891a-uufy	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.765065+00:00	Apache Tomcat Importer	Affected by	VCID-arkn-bca7-hqam	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.733717+00:00	Apache Tomcat Importer	Affected by	VCID-4aaa-errb-2qdw	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.697941+00:00	Apache Tomcat Importer	Affected by	VCID-ruuh-g3fa-m7d8	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.671273+00:00	Apache Tomcat Importer	Affected by	VCID-dzpn-w4b3-vbcm	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.619230+00:00	Apache Tomcat Importer	Affected by	VCID-yfx4-4gsc-2kgh	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.587827+00:00	Apache Tomcat Importer	Affected by	VCID-eb37-mkxf-7fgw	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.496450+00:00	Apache Tomcat Importer	Affected by	VCID-a8gk-n8bq-87cp	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.469493+00:00	Apache Tomcat Importer	Affected by	VCID-n3ab-nk7c-hqc9	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.439719+00:00	Apache Tomcat Importer	Affected by	VCID-66kh-s6cr-tqf9	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.409364+00:00	Apache Tomcat Importer	Affected by	VCID-kwab-3s4q-eka4	https://tomcat.apache.org/security-7.html	38.0.0