Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/tomcat@7.0.69-10?arch=el7
purl pkg:rpm/redhat/tomcat@7.0.69-10?arch=el7
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (8)
Vulnerability Summary Fixed by
VCID-1k8f-vsg1-k3d6
Aliases:
CVE-2016-0706
GHSA-6vx3-hr43-cfrh
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. There are no reported fixed by versions.
VCID-4mkw-7haq-pkgn
Aliases:
CVE-2014-0230
GHSA-pxcx-cxq8-4mmw
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts. There are no reported fixed by versions.
VCID-68fk-4g86-ekbp
Aliases:
CVE-2015-5345
GHSA-rh8q-vjgf-gf74
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. There are no reported fixed by versions.
VCID-9exq-fhv6-bbea
Aliases:
CVE-2016-0763
GHSA-9hjv-9h75-xmpp
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. There are no reported fixed by versions.
VCID-p6ch-pc73-b3ck
Aliases:
CVE-2015-5174
GHSA-6qr6-x7jm-x2q6
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. There are no reported fixed by versions.
VCID-pqxe-tfhk-47b7
Aliases:
CVE-2016-3092
GHSA-fvm3-cfvj-gxqq
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. There are no reported fixed by versions.
VCID-tfrs-d458-tfaq
Aliases:
CVE-2016-0714
GHSA-mv42-px54-87jw
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. There are no reported fixed by versions.
VCID-vhjj-dnft-kkf4
Aliases:
CVE-2015-5351
GHSA-w7cg-5969-678w
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:46:45.986352+00:00 RedHat Importer Affected by VCID-4mkw-7haq-pkgn https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0230.json 38.0.0
2026-04-01T14:37:51.825315+00:00 RedHat Importer Affected by VCID-9exq-fhv6-bbea https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0763.json 38.0.0
2026-04-01T14:37:51.606290+00:00 RedHat Importer Affected by VCID-68fk-4g86-ekbp https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5345.json 38.0.0
2026-04-01T14:37:51.299851+00:00 RedHat Importer Affected by VCID-1k8f-vsg1-k3d6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0706.json 38.0.0
2026-04-01T14:37:50.823056+00:00 RedHat Importer Affected by VCID-tfrs-d458-tfaq https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0714.json 38.0.0
2026-04-01T14:37:50.606287+00:00 RedHat Importer Affected by VCID-vhjj-dnft-kkf4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5351.json 38.0.0
2026-04-01T14:37:47.667952+00:00 RedHat Importer Affected by VCID-p6ch-pc73-b3ck https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5174.json 38.0.0
2026-04-01T14:36:16.566339+00:00 RedHat Importer Affected by VCID-pqxe-tfhk-47b7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-3092.json 38.0.0