VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.0

Vulnerabilities affecting this package (30)

Advisory	Summary	Fixed in package version
GHSA-9xcj-c8cr-8c3c Aliases: CVE-2019-17563	In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation …	9.0.30 Vulnerable
GHSA-qppj-fm5r-hxr3 Aliases: CVE-2023-44487	HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that …	9.0.81 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	9.0.31 Vulnerable
GHSA-c9hw-wf7x-jp9j Aliases: CVE-2020-1938	Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections …	9.0.31 Vulnerable
CVE-2022-42252 Aliases: GHSA-p22x-g9px-3945	Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was …	8.5.83 Vulnerable 9.0.68 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable
CVE-2022-25762 Aliases: GHSA-h3ch-5pp2-vh6w	Improper Resource Shutdown or Release If a web application sends a WebSocket message concurrently with the WebSocket connection closing when …	9.0.20 Vulnerable 8.5.75 Vulnerable
CVE-2019-12418 Aliases: GHSA-hh3j-x4mc-g48r	In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords …	9.0.29 Vulnerable 8.5.49 Vulnerable 7.0.99 Vulnerable
CVE-2017-7675	Path Traversal The HTTP/2 implementation in Tomcat bypassed a number of security checks that prevented directory traversal attacks. It was …	8.5.16 Vulnerable 9.0.1 Vulnerable
CVE-2017-5650	Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated …	8.5.13 Vulnerable 9.0.1 Vulnerable
CVE-2021-25329	Uncontrolled Resource Consumption The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat with a configuration edge case that was …	9.0.41 Vulnerable 7.0.107 Vulnerable 8.5.61 Vulnerable
CVE-2020-8022 Aliases: GHSA-gc58-v8h3-x2gr	A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, …	9.0.35 Vulnerable 8.0.53 Vulnerable
CVE-2016-6794	Information Exposure When a `SecurityManager` is configured, a web application's ability to read system properties should be controlled by the …	8.0.37 Vulnerable 8.5.5 Vulnerable 9.0.1 Vulnerable 7.0.72 Vulnerable
CVE-2020-13934	Denial of Service h2c does not release the `HTTP/1.1` processor after the upgrade to `HTTP/2.` If a sufficient number of …	9.0.37 Vulnerable 8.5.57 Vulnerable
CVE-2017-5664	Improper Handling of Exceptional Conditions The error page mechanism of the Java Servlet Specification requires that, when an error occurs …	7.0.78 Vulnerable 8.0.44 Vulnerable 8.5.15 Vulnerable 9.0.1 Vulnerable 7.0.52 Vulnerable 8.0.8 Vulnerable
CVE-2021-30640	Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …	8.5.66 Vulnerable 7.0.109 Vulnerable 9.0.46 Vulnerable 10.0.6 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	9.0.40 Vulnerable 10.0.2 Vulnerable 8.5.60 Vulnerable
CVE-2017-5648	Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade …	9.0.1 Vulnerable 7.0.76 Vulnerable 8.0.42 Vulnerable 8.5.12 Vulnerable
CVE-2017-5651	Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing …	8.5.13 Vulnerable 9.0.1 Vulnerable
CVE-2016-8745	Information Exposure A bug in the error handling of the NIO HTTP connector in Apache Tomcat resulted in the current …	7.0.75 Vulnerable 8.0.41 Vulnerable 8.5.9 Vulnerable 9.0.1 Vulnerable
CVE-2021-41079	Improper Input Validation Apache Tomcat does not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or …	8.5.64 Vulnerable 9.0.44 Vulnerable 10.0.4 Vulnerable
GHSA-5q99-f34m-67gc Aliases: CVE-2018-11784	Apache Tomcat Open Redirect vulnerability When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and …	9.0.12 Vulnerable 9.0.12 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	9.0.17 Vulnerable 9.0.17 Vulnerable 9.0.17 Vulnerable
GHSA-qcxh-w3j9-58qr Aliases: CVE-2019-0199	Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted …	9.0.16 Vulnerable 9.0.16 Vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
GHSA-46j3-r4pj-4835 Aliases: CVE-2018-8034	The host name verification missing in Apache Tomcat The host name verification when using TLS with the WebSocket client was …	9.0.10 Vulnerable
GHSA-6rxj-58jh-436r Aliases: CVE-2018-1304	Apache Tomcat unauthorized access vulnerability The URL pattern of "" (the empty string) which exactly maps to the context root …	9.0.5 Vulnerable
GHSA-2rvv-w9r2-rg7m Aliases: CVE-2021-24122	Information Disclosure in Apache Tomcat When serving resources from a network location using the NTFS file system, Apache Tomcat versions …	9.0.40 Vulnerable 9.0.40 Vulnerable
GHSA-jgwr-3qm3-26f3 Aliases: CVE-2021-25329	Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, …	9.0.41 Vulnerable 9.0.41 Vulnerable
GHSA-hh3j-x4mc-g48r Aliases: CVE-2019-12418	Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured …	9.0.29 Vulnerable 9.0.29 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	9.0.35 Vulnerable 9.0.35 Vulnerable 9.0.35 Vulnerable

purl	pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.0
Tags	Ghost

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0