| CVE-2022-29885 |
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to…
|
Not rated
|
May 12, 2022 |
| CVE-2022-23181 |
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to…
|
Not rated
|
Jan 27, 2022 |
| CVE-2021-42340 |
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60…
|
Not rated
|
Oct 14, 2021 |
| CVE-2021-41079 |
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets
|
Not rated
|
Sep 16, 2021 |
| CVE-2021-33037 |
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP…
|
Not rated
|
Jul 12, 2021 |
| CVE-2021-30640 |
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user…
|
Not rated
|
Jul 12, 2021 |
| CVE-2021-30639 |
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service
|
Not rated
|
Jul 12, 2021 |
| CVE-2021-25329 |
The fix for CVE-2020-9484 was incomplete
|
Not rated
|
Mar 1, 2021 |
| CVE-2021-25122 |
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0…
|
Not rated
|
Mar 1, 2021 |
| CVE-2021-24122 |
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to…
|
Not rated
|
Jan 14, 2021 |
| CVE-2020-17527 |
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and…
|
Not rated
|
Dec 3, 2020 |
| CVE-2019-12418 |
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle…
|
Not rated
|
Dec 23, 2019 |
| CVE-2019-17563 |
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a…
|
Not rated
|
Dec 23, 2019 |
| CVE-2018-11784 |
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a…
|
Not rated
|
Oct 4, 2018 |
| CVE-2018-8037 |
If an async request was completed by the application at the same time as the container triggered the async timeout, a…
|
Not rated
|
Aug 2, 2018 |
| CVE-2018-1336 |
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the…
|
Not rated
|
Aug 2, 2018 |
| CVE-2018-8034 |
The host name verification when using TLS with the WebSocket client was missing
|
7.5
High
|
Aug 1, 2018 |
| CVE-2018-8014 |
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to…
|
Not rated
|
May 16, 2018 |
| CVE-2018-1304 |
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache…
|
Not rated
|
Feb 28, 2018 |
| CVE-2018-1305 |
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1…
|
Not rated
|
Feb 23, 2018 |
| CVE-2017-15706 |
As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to…
|
Not rated
|
Jan 31, 2018 |
| CVE-2017-12617 |
Exploited
Apache Tomcat Remote Code Execution Vulnerability
|
8.1
High
|
Oct 3, 2017 |
| CVE-2017-12616 |
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints…
|
Not rated
|
Sep 19, 2017 |
| CVE-2017-12615 |
Exploited
Apache Tomcat on Windows Remote Code Execution Vulnerability
|
8.1
High
|
Sep 19, 2017 |
| CVE-2017-7675 |
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security…
|
Not rated
|
Aug 11, 2017 |