VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@8.0.0

Vulnerabilities affecting this package (22)

Advisory	Summary	Fixed in package version
GHSA-42j3-498q-m6vp Aliases: CVE-2014-0227	Improper Input Validation in Apache Tomcat `java/org/apache/coyote/http11/filters/ChunkedInputFilter.java` in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 …	8.0.9 Vulnerable
GHSA-prc3-7f44-w48j Aliases: CVE-2014-0119	Missing XML Validation in Apache Tomcat Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly …	There are no reported fixed by versions.
GHSA-xh5x-j8jf-pcpx Aliases: CVE-2014-0099	Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, …	There are no reported fixed by versions.
GHSA-475f-74wp-pqv5 Aliases: CVE-2014-0075	Integer Overflow or Wraparound in Apache Tomcat Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, …	There are no reported fixed by versions.
GHSA-qprx-q2r7-3rx6 Aliases: CVE-2014-0096	Improper Input Validation in Apache Tomcat java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and …	There are no reported fixed by versions.
GHSA-4c43-cwvx-9crh Aliases: CVE-2014-7810	Improper Access Control in Apache Tomcat The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, …	There are no reported fixed by versions.
GHSA-pxcx-cxq8-4mmw Aliases: CVE-2014-0230	Uncontrolled Resource Consumption in Apache Tomcat Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not …	8.0.9 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	8.5.51 Vulnerable
CVE-2017-5648 Aliases: GHSA-3vx3-xf6q-r5xp	Exposure of Resource to Wrong Sphere While investigating bug 60718, it was noticed that some calls to application listeners in …	8.0.42 Vulnerable 8.5.13 Vulnerable 7.0.76 Vulnerable 9.0.0.M18 Vulnerable
GHSA-w7cg-5969-678w Aliases: CVE-2015-5351	Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token The (1) Manager and (2) …	There are no reported fixed by versions.
CVE-2018-1304	Improper Access Control Unauthorised users could gain access to web application resources. Only security constraints with a URL pattern of …	8.0.50 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable 8.0.50 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2018-8014	Insecure Default Initialization of Resource The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable …	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2018-1305	Improper Access Control A vulnerability in Tomcat leads to the exposure of resources to users that are not authorised to …	7.0.85 Vulnerable 9.0.5 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2016-8735 Aliases: GHSA-cw54-59pw-4g8c	Improper Access Control Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x …	8.0.39 Vulnerable 7.0.73 Vulnerable 8.0.39 Vulnerable 7.0.73 Vulnerable
CVE-2017-5647 Aliases: GHSA-3gv7-3h64-78cm	Exposure of Sensitive Information to an Unauthorized Actor A bug in the handling of the pipelined requests in Apache Tomcat …	8.0.42 Vulnerable 8.5.13 Vulnerable 9.0.0.M19 Vulnerable 8.0.42 Vulnerable 8.5.13 Vulnerable 9.0.0.M19 Vulnerable
CVE-2018-1336	Loop with Unreachable Exit Condition (Infinite Loop) An improper handling of overflow in the UTF-8 decoder with supplementary characters can …	8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable 8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable
CVE-2018-8034	Improper Certificate Validation The host name verification when using TLS with the `WebSocket` client was missing.	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
GHSA-q6x7-f33r-3wxx Aliases: CVE-2016-6797	Incorrect Authorization in Apache Tomcat The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, …	8.0.37 Vulnerable
GHSA-3gv7-3h64-78cm Aliases: CVE-2017-5647	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat A bug in the handling of the pipelined requests …	8.0.43 Vulnerable
GHSA-jmvv-524f-hj5j Aliases: CVE-2017-5664	Improper Handling of Exceptional Conditions in Apache Tomcat The error page mechanism of the Java Servlet Specification requires that, when …	8.0.44 Vulnerable
GHSA-9hjv-9h75-xmpp Aliases: CVE-2016-0763	Improper Verification of Source of a Communication Channel in Apache Tomcat The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x …	8.0.32 Vulnerable 8.0.32 Vulnerable 8.0.32 Vulnerable
GHSA-2rvf-329f-p99g Aliases: CVE-2016-6794	System Property Disclosure in Apache Tomcat When a SecurityManager is configured, a web application's ability to read system properties should …	8.0.37 Vulnerable 8.0.37 Vulnerable

purl	pkg:maven/org.apache.tomcat/tomcat@8.0.0
Tags	Ghost

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.0

Advisory	Summary	Aliases
CVE-2013-4322	Important: Denial of service
CVE-2013-4590	Low: Information disclosure
CVE-2013-4286	Important: Information disclosure