| CVE-2022-29885 |
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to…
|
Non notée
|
12 mai 2022 |
| CVE-2022-23181 |
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to…
|
Non notée
|
27 janv. 2022 |
| CVE-2021-42340 |
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60…
|
Non notée
|
14 oct. 2021 |
| CVE-2021-41079 |
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets
|
Non notée
|
16 sept. 2021 |
| CVE-2021-33037 |
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP…
|
Non notée
|
12 juil. 2021 |
| CVE-2021-30640 |
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user…
|
Non notée
|
12 juil. 2021 |
| CVE-2021-30639 |
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service
|
Non notée
|
12 juil. 2021 |
| CVE-2021-25329 |
The fix for CVE-2020-9484 was incomplete
|
Non notée
|
1 mars 2021 |
| CVE-2021-25122 |
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0…
|
Non notée
|
1 mars 2021 |
| CVE-2021-24122 |
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to…
|
Non notée
|
14 janv. 2021 |
| CVE-2020-17527 |
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and…
|
Non notée
|
3 déc. 2020 |
| CVE-2019-12418 |
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle…
|
Non notée
|
23 déc. 2019 |
| CVE-2019-17563 |
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a…
|
Non notée
|
23 déc. 2019 |
| CVE-2018-11784 |
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a…
|
Non notée
|
4 oct. 2018 |
| CVE-2018-8037 |
If an async request was completed by the application at the same time as the container triggered the async timeout, a…
|
Non notée
|
2 août 2018 |
| CVE-2018-1336 |
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the…
|
Non notée
|
2 août 2018 |
| CVE-2018-8034 |
The host name verification when using TLS with the WebSocket client was missing
|
7.5
Élevée
|
1 août 2018 |
| CVE-2018-8014 |
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to…
|
Non notée
|
16 mai 2018 |
| CVE-2018-1304 |
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache…
|
Non notée
|
28 févr. 2018 |
| CVE-2018-1305 |
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1…
|
Non notée
|
23 févr. 2018 |
| CVE-2017-15706 |
As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to…
|
Non notée
|
31 janv. 2018 |
| CVE-2017-12617 |
Exploitée
Apache Tomcat Remote Code Execution Vulnerability
|
8.1
Élevée
|
3 oct. 2017 |
| CVE-2017-12616 |
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints…
|
Non notée
|
19 sept. 2017 |
| CVE-2017-12615 |
Exploitée
Apache Tomcat on Windows Remote Code Execution Vulnerability
|
8.1
Élevée
|
19 sept. 2017 |
| CVE-2017-7675 |
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security…
|
Non notée
|
11 août 2017 |