VulnerableCode Package Details - pkg:maven/org.apache.tomee/tomee-webapp@7.0.5

Search for packages

Vulnerability	Summary	Fixed by
VCID-46y3-rx34-pyc6 Aliases: CVE-2021-40690 GHSA-j8wc-gxx9-82hx	Exposure of Sensitive Information to an Unauthorized Actor All versions of Apache Santuario - XML Security for Java is vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.	8.0.8 Affected by 0 other vulnerabilities.
VCID-dr52-xewb-k7hv Aliases: CVE-2020-13931 GHSA-mp28-rq7g-qx62	Remote code execution in Apache TomEE If Apache TomEE - - - - is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix does not cover this edge case.	7.1.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-46y3-rx34-pyc6
Aliases:
CVE-2021-40690
GHSA-j8wc-gxx9-82hx

Exposure of Sensitive Information to an Unauthorized Actor All versions of Apache Santuario - XML Security for Java is vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

8.0.8
Affected by 0 other vulnerabilities.

VCID-dr52-xewb-k7hv
Aliases:
CVE-2020-13931
GHSA-mp28-rq7g-qx62

Remote code execution in Apache TomEE If Apache TomEE - - - - is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix does not cover this edge case.

7.1.4
Affected by 1 other vulnerability.

8.0.4
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-gvqm-rteu-w3e5	Cross-site Scripting The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation.	CVE-2018-8031 GHSA-fg44-w3fr-hgxv

Vulnerability

Summary

Aliases

VCID-gvqm-rteu-w3e5

Cross-site Scripting The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation.

CVE-2018-8031
GHSA-fg44-w3fr-hgxv

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T21:31:12.258230+00:00	GitLab Importer	Affected by	VCID-46y3-rx34-pyc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2021-40690.yml	38.4.0
2026-04-16T21:15:19.410306+00:00	GitLab Importer	Affected by	VCID-dr52-xewb-k7hv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2020-13931.yml	38.4.0
2026-04-16T20:46:28.796841+00:00	GitLab Importer	Fixing	VCID-gvqm-rteu-w3e5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2018-8031.yml	38.4.0
2026-04-11T22:44:20.967766+00:00	GitLab Importer	Affected by	VCID-46y3-rx34-pyc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2021-40690.yml	38.3.0
2026-04-11T22:27:27.368507+00:00	GitLab Importer	Affected by	VCID-dr52-xewb-k7hv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2020-13931.yml	38.3.0
2026-04-11T21:57:15.732209+00:00	GitLab Importer	Fixing	VCID-gvqm-rteu-w3e5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2018-8031.yml	38.3.0
2026-04-04T14:30:33.719788+00:00	GHSA Importer	Fixing	VCID-gvqm-rteu-w3e5	https://github.com/advisories/GHSA-fg44-w3fr-hgxv	38.1.0
2026-04-02T22:54:23.505687+00:00	GitLab Importer	Affected by	VCID-46y3-rx34-pyc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2021-40690.yml	38.1.0
2026-04-02T22:39:07.367033+00:00	GitLab Importer	Affected by	VCID-dr52-xewb-k7hv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2020-13931.yml	38.1.0
2026-04-02T22:10:38.919852+00:00	GitLab Importer	Fixing	VCID-gvqm-rteu-w3e5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2018-8031.yml	38.1.0
2026-04-01T17:12:40.888749+00:00	GitLab Importer	Affected by	VCID-46y3-rx34-pyc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2021-40690.yml	38.0.0
2026-04-01T16:56:34.099613+00:00	GitLab Importer	Affected by	VCID-dr52-xewb-k7hv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2020-13931.yml	38.0.0
2026-04-01T13:11:17.055368+00:00	GithubOSV Importer	Fixing	VCID-gvqm-rteu-w3e5	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fg44-w3fr-hgxv/GHSA-fg44-w3fr-hgxv.json	38.0.0
2026-04-01T12:47:51.910030+00:00	GitLab Importer	Fixing	VCID-gvqm-rteu-w3e5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomee/tomee-webapp/CVE-2018-8031.yml	38.0.0