VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@9.0.0

Vulnerabilities affecting this package (25)

Advisory	Summary	Fixed in package version
GHSA-44qp-qhfv-c7f6 Aliases: CVE-2021-30639	Improper Handling of Exceptional Conditions in Apache Tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a …	9.0.45 Vulnerable
GHSA-59g9-7gfx-c72p Aliases: CVE-2021-41079	Infinite loop in Tomcat due to parsing error Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 …	9.0.44 Vulnerable
GHSA-9f3j-pm6f-9fm5 Aliases: CVE-2022-23181	Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into …	9.0.58 Vulnerable
GHSA-gc58-v8h3-x2gr Aliases: CVE-2020-8022	Incorrect Default Permissions in Apache Tomcat ### Withdrawn As per https://lists.apache.org/thread/0z644xfjo49pn2oxcp9qslkvhhw4tb7q this issue only affects the SUSE built artifacts of …	9.0.35 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	9.0.31 Vulnerable
CVE-2022-42252 Aliases: GHSA-p22x-g9px-3945	Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was …	8.5.83 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable 9.0.68 Vulnerable
CVE-2020-1938	Improper Input Validation When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache …	8.5.51 Vulnerable 7.0.100 Vulnerable 9.0.31 Vulnerable
CVE-2019-0232	Improper Input Validation When running on Windows with `enableCmdLineArguments` enabled, the CGI Servlet in Apache Tomcat is vulnerable to Remote …	8.5.40 Vulnerable 7.0.94 Vulnerable 9.0.19 Vulnerable
CVE-2019-10072	HTTP/2 DoS The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache …	8.5.41 Vulnerable 9.0.20 Vulnerable
CVE-2021-30640	Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …	8.5.66 Vulnerable 7.0.109 Vulnerable 9.0.46 Vulnerable 10.0.6 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	8.5.60 Vulnerable 10.0.2 Vulnerable 9.0.40 Vulnerable
CVE-2017-15706	Improperly Implemented Security Check for Standard Some scripts may have failed to execute as expected and other scripts may have …	8.0.48 Vulnerable 8.5.24 Vulnerable 7.0.84 Vulnerable 9.0.2 Vulnerable
CVE-2020-1935	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) In Apache Tomcat, the HTTP header parsing code used an approach to …	8.5.51 Vulnerable 7.0.100 Vulnerable 9.0.31 Vulnerable
CVE-2017-7674	Insufficient Verification of Data Authenticity The CORS Filter in Apache Tomcat does not add an HTTP Vary header indicating that …	8.0.45 Vulnerable 8.5.16 Vulnerable 7.0.79 Vulnerable 9.0.1 Vulnerable
CVE-2023-46589	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …	8.5.96 Vulnerable 9.0.83 Vulnerable 10.1.16 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	8.5.60 Vulnerable 7.0.107 Vulnerable 10.0.0-M10 Vulnerable 9.0.40 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	9.0.17 Vulnerable 9.0.17 Vulnerable
CVE-2018-1304	Improper Access Control Unauthorised users could gain access to web application resources. Only security constraints with a URL pattern of …	8.0.50 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable 8.0.50 Vulnerable 8.5.28 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2018-8014	Insecure Default Initialization of Resource The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable …	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2018-8037	Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) Tomcat contains a race condition that could result in a …	8.5.32 Vulnerable 9.0.10 Vulnerable 8.5.32 Vulnerable 9.0.10 Vulnerable
CVE-2018-11784	URL Redirection to Untrusted Site (Open Redirect) When the default servlet in Apache Tomcat returns a redirect to a directory, …	8.5.34 Vulnerable 7.0.91 Vulnerable 9.0.12 Vulnerable 8.5.34 Vulnerable 7.0.91 Vulnerable 9.0.12 Vulnerable
CVE-2018-1336	Loop with Unreachable Exit Condition (Infinite Loop) An improper handling of overflow in the UTF-8 decoder with supplementary characters can …	8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable 8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable
CVE-2018-8034	Improper Certificate Validation The host name verification when using TLS with the `WebSocket` client was missing.	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2021-43980 Aliases: GHSA-jx7c-7mj5-9438	Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to …	There are no reported fixed by versions.
CVE-2017-12617	Important: Remote Code Execution	9.0.1 Vulnerable

purl	pkg:maven/org.apache.tomcat/tomcat@9.0.0
Tags	Ghost

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0