Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@9.0.0.M18 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7b1n-ck2m-rbfu
Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm |
Affected by 8 other vulnerabilities. |
|
|
VCID-8m28-utzk-x7gj
Aliases: CVE-2022-25762 GHSA-h3ch-5pp2-vh6w |
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors. |
Affected by 18 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-anxt-ts7w-wye1
Aliases: CVE-2019-17563 GHSA-9xcj-c8cr-8c3c |
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. |
Affected by 17 other vulnerabilities. |
|
VCID-aycw-nzkw-buhj
Aliases: CVE-2019-12418 GHSA-hh3j-x4mc-g48r |
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. |
Affected by 17 other vulnerabilities. |
|
VCID-dzsr-5hq1-47fd
Aliases: CVE-2017-5651 GHSA-9hg2-395j-83rm |
Affected by 8 other vulnerabilities. |
|
|
VCID-ekhp-s7kg-ebdy
Aliases: CVE-2024-21733 GHSA-f4qf-m5gf-8jm8 |
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue. |
Affected by 10 other vulnerabilities. |
|
VCID-nq3y-spqj-qyca
Aliases: CVE-2018-1305 GHSA-jx6h-3fjx-cgv5 |
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them. |
Affected by 26 other vulnerabilities. |
|
VCID-ta6y-kc43-e3ap
Aliases: CVE-2017-7675 GHSA-68g5-8q7f-m384 |
Affected by 7 other vulnerabilities. |
|
|
VCID-uy2u-497k-y7fh
Aliases: CVE-2017-5664 GHSA-jmvv-524f-hj5j |
Affected by 8 other vulnerabilities. |
|
|
VCID-wqne-fp1b-5bb2
Aliases: CVE-2017-5650 GHSA-9785-w233-x6hv |
Affected by 8 other vulnerabilities. |
|
|
VCID-znaw-aejz-u7ba
Aliases: CVE-2019-0199 GHSA-qcxh-w3j9-58qr |
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. |
Affected by 21 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-s2yw-ayf9-gfgp |
CVE-2017-5648
GHSA-3vx3-xf6q-r5xp |