VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@8.0.14

Vulnerabilities affecting this package (66)

Advisory	Summary	Fixed in package version
CVE-2018-8034	Low: host name verification missing in WebSocket client	8.0.53 Vulnerable
CVE-2018-8014	Low: CORS filter has insecure defaults	8.0.53 Vulnerable 8.5.32 Vulnerable
CVE-2018-1336	Important: A bug in the UTF-8 decoder can lead to DoS	8.0.52 Vulnerable
CVE-2018-1305	Important: Security constraint annotations applied too late	8.0.50 Vulnerable
CVE-2018-1304	Important: Security constraints mapped to context root are ignored	8.0.50 Vulnerable
CVE-2017-12617	Important: Remote Code Execution	8.0.47 Vulnerable
CVE-2017-7674	Moderate: Cache Poisoning	8.0.45 Vulnerable
CVE-2017-5664	Important: Security Constraint Bypass	8.0.44 Vulnerable
CVE-2017-5647	Important: Information Disclosure	8.0.43 Vulnerable
CVE-2017-5648	Low: Information Disclosure	8.0.42 Vulnerable
CVE-2016-8745	Important: Information Disclosure	8.0.41 Vulnerable
CVE-2016-8735	Important: Remote Code Execution	8.0.39 Vulnerable
CVE-2016-6816	Important: Information Disclosure	8.0.39 Vulnerable
CVE-2016-6797	Low: Unrestricted Access to Global Resources	8.5.5 Vulnerable
CVE-2016-6796	Low: Security Manager Bypass	8.5.5 Vulnerable
CVE-2016-6794	Low: System Property Disclosure	8.5.5 Vulnerable
CVE-2016-5018	Low: Security Manager Bypass	8.5.5 Vulnerable
CVE-2016-0762	Low: Timing Attack	8.5.5 Vulnerable
CVE-2016-3092	Moderate: Denial of Service	8.5.3 Vulnerable
CVE-2015-5346	Low: Session Fixation	8.0.32 Vulnerable
CVE-2015-5351	Moderate: CSRF token leak	8.0.32 Vulnerable
CVE-2016-0706	Low: Security Manager bypass	8.0.32 Vulnerable
CVE-2016-0714	Moderate: Security Manager bypass	8.0.32 Vulnerable
CVE-2016-0763	Moderate: Security Manager bypass	8.0.32 Vulnerable
CVE-2015-5345	Low: Directory disclosure	8.0.30 Vulnerable
CVE-2015-5174	Low: Limited directory traversal	8.0.27 Vulnerable
CVE-2014-7810	Moderate: Security Manager bypass	8.0.17 Vulnerable
CVE-2013-4286	Important: Information disclosure	There are no reported fixed by versions.
CVE-2018-8014	Low: CORS filter has insecure defaults	There are no reported fixed by versions.
GHSA-44qp-qhfv-c7f6 Aliases: CVE-2021-30639	Improper Handling of Exceptional Conditions in Apache Tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a …	8.5.65 Vulnerable
GHSA-9f3j-pm6f-9fm5 Aliases: CVE-2022-23181	Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into …	8.5.75 Vulnerable
GHSA-gc58-v8h3-x2gr Aliases: CVE-2020-8022	Incorrect Default Permissions in Apache Tomcat ### Withdrawn As per https://lists.apache.org/thread/0z644xfjo49pn2oxcp9qslkvhhw4tb7q this issue only affects the SUSE built artifacts of …	8.0.53 Vulnerable
GHSA-4c43-cwvx-9crh Aliases: CVE-2014-7810	Improper Access Control in Apache Tomcat The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, …	There are no reported fixed by versions.
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	8.5.51 Vulnerable
CVE-2017-5648 Aliases: GHSA-3vx3-xf6q-r5xp	Exposure of Resource to Wrong Sphere While investigating bug 60718, it was noticed that some calls to application listeners in …	8.0.42 Vulnerable 8.5.13 Vulnerable 7.0.76 Vulnerable 9.0.0.M18 Vulnerable
CVE-2017-7674	Insufficient Verification of Data Authenticity The CORS Filter in Apache Tomcat does not add an HTTP Vary header indicating that …	8.0.45 Vulnerable 8.5.16 Vulnerable 7.0.79 Vulnerable 9.0.1 Vulnerable
GHSA-w7cg-5969-678w Aliases: CVE-2015-5351	Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token The (1) Manager and (2) …	There are no reported fixed by versions.
GHSA-mv42-px54-87jw Aliases: CVE-2016-0714	Improper Access Control in Apache Tomcat The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before …	8.0.32 Vulnerable 8.0.32 Vulnerable
GHSA-rh8q-vjgf-gf74 Aliases: CVE-2015-5345	Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat The Mapper component in Apache Tomcat 6.x before …	8.0.30 Vulnerable 8.0.30 Vulnerable
CVE-2018-1304	Improper Access Control Unauthorised users could gain access to web application resources. Only security constraints with a URL pattern of …	8.0.50 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable 8.0.50 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2026-24880 Aliases: GHSA-563x-q5rq-57qp	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable
CVE-2018-8014	Insecure Default Initialization of Resource The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable …	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2018-1305	Improper Access Control A vulnerability in Tomcat leads to the exposure of resources to users that are not authorised to …	7.0.85 Vulnerable 9.0.5 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2016-8735 Aliases: GHSA-cw54-59pw-4g8c	Improper Access Control Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x …	8.0.39 Vulnerable 7.0.73 Vulnerable 8.0.39 Vulnerable 7.0.73 Vulnerable
CVE-2017-5647 Aliases: GHSA-3gv7-3h64-78cm	Exposure of Sensitive Information to an Unauthorized Actor A bug in the handling of the pipelined requests in Apache Tomcat …	8.0.42 Vulnerable 8.5.13 Vulnerable 9.0.0.M19 Vulnerable 8.0.42 Vulnerable 8.5.13 Vulnerable 9.0.0.M19 Vulnerable
CVE-2018-1336	Loop with Unreachable Exit Condition (Infinite Loop) An improper handling of overflow in the UTF-8 decoder with supplementary characters can …	8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable 8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable
CVE-2018-8034	Improper Certificate Validation The host name verification when using TLS with the `WebSocket` client was missing.	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2016-6816 Aliases: GHSA-jc7p-5r39-9477	Improper Input Validation The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, …	8.0.39 Vulnerable 8.5.8 Vulnerable 7.0.73 Vulnerable 8.0.39 Vulnerable 8.5.8 Vulnerable 7.0.73 Vulnerable
CVE-2018-8014	Low: CORS filter has insecure defaults	There are no reported fixed by versions.
GHSA-q6x7-f33r-3wxx Aliases: CVE-2016-6797	Incorrect Authorization in Apache Tomcat The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, …	9.0.0.M10 Vulnerable 8.5.5 Vulnerable 8.0.37 Vulnerable 8.0.37 Vulnerable
GHSA-73rx-3f9r-x949 Aliases: CVE-2017-7674	Insufficient Verification of Data Authenticity in Apache Tomcat The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, …	9.0.0.M22 Vulnerable 8.5.16 Vulnerable 8.0.45 Vulnerable 9.0.0.M22 Vulnerable 8.5.16 Vulnerable 8.0.45 Vulnerable 8.0.45 Vulnerable
GHSA-jrcp-c39h-r29x Aliases: CVE-2015-5346	Improper Neutralization of Input During Web Page Generation in Apache Tomcat Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, …	There are no reported fixed by versions.
GHSA-3gv7-3h64-78cm Aliases: CVE-2017-5647	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat A bug in the handling of the pipelined requests …	9.0.0.M19 Vulnerable 8.5.13 Vulnerable 8.0.43 Vulnerable 9.0.0.M19 Vulnerable 8.5.13 Vulnerable 8.0.43 Vulnerable 8.0.43 Vulnerable
GHSA-jmvv-524f-hj5j Aliases: CVE-2017-5664	Improper Handling of Exceptional Conditions in Apache Tomcat The error page mechanism of the Java Servlet Specification requires that, when …	9.0.0.M21 Vulnerable 8.5.15 Vulnerable 8.0.44 Vulnerable 9.0.0.M21 Vulnerable 8.5.15 Vulnerable 8.0.44 Vulnerable 8.0.44 Vulnerable
GHSA-wxcp-f2c8-x6xv Aliases: CVE-2016-0762	Observable Discrepancy in Apache Tomcat The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to …	9.0.0.M10 Vulnerable 8.5.5 Vulnerable 8.0.37 Vulnerable 8.0.37 Vulnerable
GHSA-3mjp-p938-4329 Aliases: CVE-2016-6796	Apache Tomcat vulnerable to SecurityManager bypass A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, …	9.0.0.M10 Vulnerable 8.5.5 Vulnerable 8.0.37 Vulnerable 8.0.37 Vulnerable
GHSA-6vx3-hr43-cfrh Aliases: CVE-2016-0706	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x …	There are no reported fixed by versions.
GHSA-6qr6-x7jm-x2q6 Aliases: CVE-2015-5174	Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat Directory traversal vulnerability in RequestUtil.java in Apache Tomcat …	8.0.27 Vulnerable 8.0.27 Vulnerable 8.0.27 Vulnerable
GHSA-9hjv-9h75-xmpp Aliases: CVE-2016-0763	Improper Verification of Source of a Communication Channel in Apache Tomcat The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x …	8.0.32 Vulnerable 9.0.0.M3 Vulnerable 8.0.32 Vulnerable 9.0.0.M3 Vulnerable 8.0.32 Vulnerable
GHSA-2rvf-329f-p99g Aliases: CVE-2016-6794	System Property Disclosure in Apache Tomcat When a SecurityManager is configured, a web application's ability to read system properties should …	8.0.37 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.4