[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*


oval:org.secpod.oval:def:52830
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Details: USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. Original advis ...

oval:org.secpod.oval:def:14059
The host is installed with Apache Tomcat 7.x before 7.0.40 and is prone to information disclosure vulnerability. A flaw is present in the application, which fails to properly handle the throwing of a RuntimeException in an AsyncListener in an application. Successful exploitation allows attackers to ...

oval:org.secpod.oval:def:20834
The host is installed with Apache Tomcat 7.x before 7.0.22 and is prone to privilege escalation vulnerability. A flaw is present in the application, which does not properly restrict ContainerServlets in the Manager application. Successful exploitation allows remote attackers to gain privileges by us ...

oval:org.secpod.oval:def:25125
The host is installed with Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58 or 8.x before 8.0.16 and is prone to a security bypass vulnerability. A flaw is present in the Expression Language (EL) implementation, which does not properly consider the possibility of an accessible interface implemente ...

oval:org.secpod.oval:def:25126
The host is installed with Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55 or 8.x before 8.0.9 and is prone to a denial of service vulnerability. A flaw is present in application, which does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request ...

oval:org.secpod.oval:def:702622
tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:702625
tomcat7: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:7987
The host is installed with Apache Tomcat 6.x before 6.0.36 or 7.x before 7.0.28 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to properly restrict the request-header size. Successful exploitation allows remote attackers to cause a denial of servic ...

oval:org.secpod.oval:def:601258
Multiple security issues were found in the Tomcat servlet and JSP engine: CVE-2013-2067 FORM authentication associates the most recent request requiring authentication with the current session. By repeatedly sending a request for an authenticated resource while the victim is completing the login for ...

oval:org.secpod.oval:def:33193
The host is installed with Apache Tomcat 7.0.x before 7.0.51 and is prone to a denial of service vulnerability. A flaw is present in the application, which fails handle a crafted Content-Type header that bypasses a loop's intended exit conditions. Successful exploitation allows remote attackers to c ...

oval:org.secpod.oval:def:702144
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:703451
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Details: USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. Original advis ...

oval:org.secpod.oval:def:7942
The host is installed with Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, or 7.x before 7.0.30 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to properly check for stale nonce values in conjunction with enforcement of proper credentials in the ...

oval:org.secpod.oval:def:7943
The host is installed with Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, or 7.x before 7.0.30 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to properly handle caches information in the HTTP Digest Access Authentication implementation. Succes ...

oval:org.secpod.oval:def:8234
The host is installed with Apache Tomcat 6.x before 6.0.36 or 7.x before 7.0.28 and is prone to denial of service vulnerability. A flaw is present in the application, which is caused when the NIO connector is used in conjunction with sendfile and HTTPS. Successful exploitation allows remote attacker ...

oval:org.secpod.oval:def:8235
The host is installed with Apache Tomcat 6.x before 6.0.36 or 7.x before 7.0.32 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to handle a request that lacks a session identifier. Successful exploitation allows remote attackers to bypass the cross-si ...

oval:org.secpod.oval:def:723
The host is installed with Apache Tomcat and is prone to information disclosure vulnerability. A flaw is present in the HTTP BIO connector, which fails to handle HTTP pipelining and mixes up the responses between requests. Successful exploitation could allow remote attackers to obtain sensitive info ...

oval:org.secpod.oval:def:701594
tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:601209
It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition.

oval:org.secpod.oval:def:8085
The host is installed with Apache Tomcat through 7.0.x and is prone to denial of service vulnerability. A flaw is present in the application, which fails to handle the partial HTTP requests. Successful exploitation allows remote attackers to cause a denial of service (daemon outage).

oval:org.secpod.oval:def:203393
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag lib ...

oval:org.secpod.oval:def:1556
The host is installed with Apache Tomcat version 7.0.0 through 7.0.19, 6.0.0 through 6.0.33 and 5.5.0 through 5.5.34 and is prone to information disclosure vulnerability. A flaw is present in the application, which fails to handle HTTP APR or HTTP NIO connector when sendfile is enabled. Successful e ...

oval:org.secpod.oval:def:395
The host is installed with Apache Tomcat and is prone to security bypass vulnerability. A flaw is present in the application which is caused by an error related to ignoring ServletSecurity annotations. Successful exploitation allow attackers to bypass security restrictions and launch further attacks ...

oval:org.secpod.oval:def:203313
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encodin ...

oval:org.secpod.oval:def:203350
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat ...

oval:org.secpod.oval:def:203391
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity attacks. An attacker able to de ...

oval:org.secpod.oval:def:600727
Several vulnerabilities have been found in Tomcat, a servlet and JSP engine: CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 The HTTP Digest Access Authentication implementation performed insufficient countermeasures against replay attacks. CVE-2011-2204 In rare setups passwords were written ...

oval:org.secpod.oval:def:3939
The host is installed with Apache Tomcat 6.x before 6.0.34, and 7.x before 7.0.23 and is prone to an information disclosure vulnerability. A flaw is present in the application, which fails to properly perform certain caching and recycling operations involving request objects. Successful exploitation ...

oval:org.secpod.oval:def:2277
The host is installed with Apache Tomcat 7.0.0 through 7.0.20, or 6.0.0 through 6.0.33 or 5.5.0 through 5.5.33 and is prone to security bypass vulnerability. A flaw is present in the application which is caused by the improper handling of messages by the AJP protocol. Successful exploitation allows ...

oval:org.secpod.oval:def:500262
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. APR as mentioned in the CVE-2011-3190 and CVE-2011-2526 descriptions does not refer to APR provided by the apr packages. It refers to the implementation of APR provided by the Tomcat Native library, which ...

oval:org.secpod.oval:def:1518
The host is installed with Apache Tomcat and is prone to an information disclosure vulnerability. A flaw is present in the application, which stores passwords in log files if errors are encountered during JMX user creation. Successful exploitation could allow an attacker to read log files and obtain ...

oval:org.secpod.oval:def:396
The host is installed with Apache Tomcat and is prone to security bypass vulnerability. A flaw is present in web.xml in the application which is caused by an error related to ignoring ServletSecurity annotations. Successful exploitation allow attackers to bypass security restrictions and launch furt ...

oval:org.secpod.oval:def:1500647
It was found that a fix for a previous security flaw introduced a regression that could cause a denial of service in Tomcat 7. A remote attacker could use this flaw to consume an excessive amount of CPU on the Tomcat server by sending a specially crafted request to that server. It was found that whe ...

oval:org.secpod.oval:def:1500676
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could ...

oval:org.secpod.oval:def:1500678
Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are available for each vulnera ...

oval:org.secpod.oval:def:1500608
Updated tomcat6 packages that fix three security issues and two bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, ...

oval:org.secpod.oval:def:1600155
It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this flaw t ...

oval:org.secpod.oval:def:1500571
Updated tomcat6 packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are available ...

oval:org.secpod.oval:def:1600176
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service via a crafted Content-Type header that bypasses a loop"s intended exit conditions.

oval:org.secpod.oval:def:106385
The javax.servlet package lacks support for rfc 1867, html file upload. This package provides a simple to use api for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest

oval:org.secpod.oval:def:106396
The javax.servlet package lacks support for rfc 1867, html file upload. This package provides a simple to use api for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest

oval:org.secpod.oval:def:501323
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that a fix for a previous security flaw introduced a regression that could cause a denial of service in Tomcat 7. A remote attacker could use this flaw to consume an excessive amount of CPU on ...

oval:org.secpod.oval:def:501271
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encodin ...

oval:org.secpod.oval:def:3938
The host is installed with Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 and is prone to a denial of service vulnerability. A flaw is present in the application, which uses an inefficient approach for handling parameter. Successful exploitation could allow attackers to ...

oval:org.secpod.oval:def:3749
The host is installed with Apache Tomcat 5.5.x before 5.5.34 or 6.x before 6.0.33 or 7.x before 7.0.12 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to properly handle Catalina in HTTP Digest Access Authentication implementation. Successful exploita ...

oval:org.secpod.oval:def:3750
The host is installed with Apache Tomcat 5.5.x before 5.5.34 or 6.x before 6.0.33 or 7.x before 7.0.12 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to check realm values. Successful exploitation allows remote attackers to bypass intended access res ...

oval:org.secpod.oval:def:3751
The host is installed with Apache Tomcat 5.5.x before 5.5.34 or 6.x before 6.0.33 or 7.x before 7.0.12 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to check qop values. Successful exploitation allows remote attackers to bypass intended integrity-pr ...

oval:org.secpod.oval:def:3725
The host is installed with Apache Tomcat before 5.5.35 or 6.x before 6.0.35 or 7.x before 7.0.23 and is prone to denial-of-service vulnerability. A flaw is present in the application, which computes hash values for form parameters without restricting the ability to trigger hash collisions. Successfu ...

oval:org.secpod.oval:def:20833
The host is installed with Apache Tomcat 7.0.x before 7.0.17 and is prone to unspecified vulnerability. A flaw is present in the application, which fails handle a crafted application. Successful exploitation allows remote attackers to read or modify the (1) web.xml, (2) context.xml, or (3) tld files ...

oval:org.secpod.oval:def:14058
The host is installed with Apache Tomcat 6.x before 6.0.37 or 7.x before 7.0.30 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to properly handle chunk extensions in chunked transfer coding. Successful exploitation allows attackers to cause a denia ...

oval:org.secpod.oval:def:14060
The host is installed with Apache Tomcat 6.0.21 through 6.0.36 or 7.x before 7.0.33 and is prone to session fixation vulnerability. A flaw is present in the application, which fails to properly handle the relationships between authentication requirements and sessions. Successful exploitation allows ...

oval:org.secpod.oval:def:1500116
Updated tomcat6 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 6.The Red Hat Security Response Team has rated this update as havingimportant security impact. Common Vulnerability Scoring System basescores, which give detailed severity ratings, are available ...

oval:org.secpod.oval:def:7944
The host is installed with Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, or 7.x before 7.0.30 and is prone to security bypass vulnerability. A flaw is present in the application, which fails to properly handle the replay-countermeasure functionality in the HTTP Digest Access Authentication i ...

oval:org.secpod.oval:def:8233
The host is installed with Apache Tomcat 6.x before 6.0.36 or 7.x before 7.0.30 and is prone to security bypass vulnerability. A flaw is present in the application, which is caused when FORM authentication is used. Successful exploitation allows remote attackers to bypass security-constraint checks ...

oval:org.secpod.oval:def:601073
Two security issues have been found in the Tomcat servlet and JSP engine: CVE-2012-3544 The input filter for chunked transfer encodings could trigger high resource consumption through malformed CRLF sequences, resulting in denial of service. CVE-2013-2067 The FormAuthenticator module was vulnerable ...

oval:org.secpod.oval:def:3752
The host is installed with Apache Tomcat 5.5.x before 5.5.34 or 6.x before 6.0.33 or 7.x before 7.0.12 and is prone to security bypass vulnerability. A flaw is present in the application, which does not have the expected countermeasures against replay attacks. Successful exploitation allows remote a ...

oval:org.secpod.oval:def:107624
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:1600855
Late application of security constraints can lead to resource exposure for unauthorised users:Security constraints defined by annotations of Servlets in Apache Tomcat were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any U ...

oval:org.secpod.oval:def:1600856
Incorrect documentation of CGI Servlet search algorithm may lead to misconfiguration:As part of the fix for bug 61201, the documentation for Apache Tomcat included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. ...

oval:org.secpod.oval:def:38802
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:204699
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * A vulnerability was discovered in Tomcat"s handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to b ...

oval:org.secpod.oval:def:204472
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid character ...

oval:org.secpod.oval:def:204462
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid character ...

oval:org.secpod.oval:def:111608
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:111607
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:204677
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a later upstream version: tomcat . Security Fix: * The Realm implementations did not process the supplied password if the supplied user name did not exist. This ...

oval:org.secpod.oval:def:502188
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * A vulnerability was discovered in Tomcat"s handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to b ...

oval:org.secpod.oval:def:502190
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * A vulnerability was discovered in Tomcat"s handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to b ...

oval:org.secpod.oval:def:204700
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * A vulnerability was discovered in Tomcat"s handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to b ...

oval:org.secpod.oval:def:1502052
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1502051
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:40406
The host is installed with Apache Tomcat 7.x before 7.0.76, 8.x before 8.0.42, 8.5.x before 8.5.12 or 9.x before 9.0.0.M18 and is prone to an information disclosure vulnerability. A flaw is present in the Application, which did not use the appropriate facade object. Successful exploitation allows un ...

oval:org.secpod.oval:def:113662
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:46893
The host is installed with Apache Tomcat 7.x before 7.0.80 and is prone to a remote code execution vulnerability. A flaw is present in the readonly initialization parameter of the default servlet, when running with HTTP PUTs enabled. Successful exploitation allows attackers to upload a JSP file to t ...

oval:org.secpod.oval:def:204545
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * A vulnerability was discovered in the error page mechanism in Tomcat"s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the remova ...

oval:org.secpod.oval:def:113407
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:113408
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:111769
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:111761
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:111758
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:40403
The host is installed with Apache Tomcat 6.0 before 6.0.52, 7.x before 7.0.76, 8.x before 8.0.42, 8.5.x before 8.5.12 or 9.x before 9.0.0.M19 and is prone to an unspecified vulnerability. A flaw is present in the Application, which fails to handle pipelined requests. Successful exploitation could re ...

oval:org.secpod.oval:def:39740
The host is installed with Apache Tomcat 6.0.x to 6.0.47, 7.x to 7.0.72, 8.0.0 to 8.0.38, 8.5.x to 8.5.6 or 9.0.0.M1 to 9.0.0.M11 and is prone to a cross-site scripting vulnerability. A flaw is present in the application, which does not properly handle certain inconsistent HTTP request headers. Succ ...

oval:org.secpod.oval:def:1501407
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. This update ...

oval:org.secpod.oval:def:602335
It was discovered that malicious web applications could use the Expression Language to bypass protections of a Security Manager as expressions were evaluated within a privileged code section.

oval:org.secpod.oval:def:1200005
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessiv ...

oval:org.secpod.oval:def:20843
The host is installed with Apache Tomcat 6.0.x before 6.0.40, 7.x before 7.0.54 or 8.x before 8.0.6 and is prone to information disclosure vulnerability. A flaw is present in the application, which fails to handle a crafted web application. Successful exploitation allows remote attackers to (1) read ...

oval:org.secpod.oval:def:602469
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager.

oval:org.secpod.oval:def:20841
The host is installed with Apache Tomcat 6.0.x before 6.0.40, 7.x before 7.0.53 or 8.x before 8.0.4 and is prone to information disclosure vulnerability. A flaw is present in the application, which does not properly restrict XSLT stylesheets. Successful exploitation allows remote attackers to bypas ...

oval:org.secpod.oval:def:20842
The host is installed with Apache Tomcat 6.0.x before 6.0.40, 7.x before 7.0.53 or 8.x before 8.0.4 and is prone to information disclosure vulnerability. A flaw is present in the application, which fails to handle a crafted Content-Length HTTP header. Successful exploitation allows remote attackers ...

oval:org.secpod.oval:def:204021
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicio ...

oval:org.secpod.oval:def:501791
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. This updat ...

oval:org.secpod.oval:def:23701
The host is installed with Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55 or 8.x before 8.0.9 and is prone to a denial of service vulnerability. A flaw is present in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java, which does not properly handle attempts to continue reading data af ...

oval:org.secpod.oval:def:1200067
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessiv ...

oval:org.secpod.oval:def:1200188
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.

oval:org.secpod.oval:def:108433
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:501360
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity attacks. An attacker able to de ...

oval:org.secpod.oval:def:501362
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag lib ...

oval:org.secpod.oval:def:1600343
A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths cal ...

oval:org.secpod.oval:def:1600331
It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. It was found that Tomcat would keep connections open after processing requests with a large enough reques ...

oval:org.secpod.oval:def:20839
The host is installed with Apache Tomcat 6.0.x before 6.0.40, 7.x before 7.0.53 or 8.x before 8.0.4 and is prone to denial of service vulnerability. A flaw is present in the application, which fails to handle a malformed chunk size in chunked transfer coding of a request. Successful exploitation all ...

oval:org.secpod.oval:def:501564
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make T ...

oval:org.secpod.oval:def:1600351
A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths cal ...

oval:org.secpod.oval:def:501570
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make T ...

oval:org.secpod.oval:def:501332
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat ...

oval:org.secpod.oval:def:602436
Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation.

oval:org.secpod.oval:def:602314
It was discovered that malicious web applications could use the Expression Language to bypass protections of a Security Manager as expressions were evaluated within a privileged code section.

oval:org.secpod.oval:def:1501009
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make T ...

oval:org.secpod.oval:def:1501007
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make T ...

oval:org.secpod.oval:def:501880
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application de ...

oval:org.secpod.oval:def:204023
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application de ...

oval:org.secpod.oval:def:1501600
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application dep ...

oval:org.secpod.oval:def:46902
The host is installed with Apache Tomcat 8.5.x before 8.5.9, 8.0.x before 8.0.40, 6.x before 6.0.49, 7.x before 7.0.74 or 9.x before 9.0.0.M14 and is prone to an information disclosure vulnerability. A flaw is present in the application which fails to handle the send file code for the NIO HTTP conne ...

oval:org.secpod.oval:def:112060
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:501881
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicio ...

oval:org.secpod.oval:def:1900564
A bug in the error handling of the send file code for the NIO HTTPconnector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant ...

oval:org.secpod.oval:def:1600504
A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information lea ...

oval:org.secpod.oval:def:1600425
Tomcat"s CGI support used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly ...

oval:org.secpod.oval:def:112161
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:602731
It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure.

oval:org.secpod.oval:def:1901153
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an ap ...

oval:org.secpod.oval:def:602730
It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure.

oval:org.secpod.oval:def:703436
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:1501599
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application dep ...

oval:org.secpod.oval:def:1900349
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed.This coul ...

oval:org.secpod.oval:def:502071
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * A vulnerability was discovered in the error page mechanism in Tomcat"s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the remova ...

oval:org.secpod.oval:def:1600740
Security constrained bypass in error page mechanism:A vulnerability was discovered in the error page mechanism in Tomcats DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page

oval:org.secpod.oval:def:703934
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:1900339
The error page mechanism of the Java Servlet Specification requires that,when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original H ...

oval:org.secpod.oval:def:1600732
Security constrained bypass in error page mechanism:A vulnerability was discovered in the error page mechanism in Tomcat"s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page

oval:org.secpod.oval:def:112510
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:1600733
Security constrained bypass in error page mechanism:A vulnerability was discovered in the error page mechanism in Tomcat"s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page

oval:org.secpod.oval:def:51964
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:112509
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:53088
Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request"s HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement o ...

oval:org.secpod.oval:def:53087
Aniket Nandkishor Kulkarni discovered that in tomcat7, a servlet and JSP engine, static error pages used the original request"s HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement o ...

oval:org.secpod.oval:def:1600688
Incorrect handling of pipelined requests when send file was used:A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost wh ...

oval:org.secpod.oval:def:602966
Aniket Nandkishor Kulkarni discovered that in tomcat7, a servlet and JSP engine, static error pages used the original request"s HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement o ...

oval:org.secpod.oval:def:602967
Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request"s HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement o ...

oval:org.secpod.oval:def:1501935
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:46897
The host is installed with Apache Tomcat 7.x before 7.0.78, 8.0.x before 8.0.44, 8.5.x before 8.5.15 or 9.x before 9.0.0.M21 and is prone to a security bypass vulnerability. A flaw is present in the security constraint defined by annotations of servlets. Successful exploitation exposes resources to ...

oval:org.secpod.oval:def:602868
Two vulnerabilities were discovered in tomcat7, a servlet and JSP engine. CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. CVE-2017-5648 Some application listeners calls were issued against the wrong objects ...

oval:org.secpod.oval:def:1600690
Incorrect handling of pipelined requests when send file was usedA bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost whe ...

oval:org.secpod.oval:def:602869
Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine. CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. CVE-2017-5648 Some application listeners calls were issued against the wrong objects ...

oval:org.secpod.oval:def:112317
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:112319
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:114237
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:114236
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory e ...

oval:org.secpod.oval:def:1600797
A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution

oval:org.secpod.oval:def:46881
The host is installed with Apache Tomcat 7.x before 7.0.82, 8.0.x before 8.0.47, 8.5.x before 8.5.23 or 9.0.0.M1 before 9.0.1 and is prone to an information disclosure vulnerability. A flaw is present in the readonly initialization parameter of the default servlet, when running with HTTP PUTs enable ...

oval:org.secpod.oval:def:46895
The host is installed with Apache Tomcat 7.x before 7.0.85, 8.0.x before 8.0.50, 8.5.x before 8.5.28 or 9.x before 9.0.5 and is prone to a security bypass vulnerability. A flaw is present in the security constraint definition with a URL pattern of the empty string. Successful exploitation allows att ...

oval:org.secpod.oval:def:46896
The host is installed with Apache Tomcat 7.x before 7.0.85, 8.0.x before 8.0.50, 8.5.x before 8.5.28 or 9.x before 9.0.5 and is prone to a security bypass vulnerability. A flaw is present in the security constraint defined by annotations of servlets. Successful exploitation exposes resources to user ...

oval:org.secpod.oval:def:46901
The host is installed with Apache Tomcat 8.5.x before 8.5.5, 8.0.x before 8.0.37, 6.x before 6.0.46, 7.x before 7.0.71 or 9.x before 9.0.0.M10 and is prone to a security bypass vulnerability. A flaw is present in the application which fails to handle the web application access to global JNDI resour ...

oval:org.secpod.oval:def:46900
The host is installed with Apache Tomcat 8.5.x before 8.5.5, 8.0.x before 8.0.37, 6.x before 6.0.46, 7.x before 7.0.71 or 9.x before 9.0.0.M10 and is prone to a security bypass vulnerability. A flaw is present in the application which fails to handle the configured SecurityManager. Successful explo ...

oval:org.secpod.oval:def:46906
The host is installed with Apache Tomcat 8.5.x before 8.5.5, 8.0.x before 8.0.37, 6.x before 6.0.46, 7.x before 7.0.71 or 9.x before 9.0.0.M10 and is prone to a security bypass vulnerability. A flaw is present in the application which fails to handle a malicious web application running on Apache To ...

oval:org.secpod.oval:def:51706
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Several security issues were fixed in Tomcat.

oval:org.secpod.oval:def:1900565
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a differe ...

oval:org.secpod.oval:def:1501797
CVE-2016-6816 : The code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the a ...

oval:org.secpod.oval:def:502085
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a later upstream version: tomcat . Security Fix: * The Realm implementations did not process the supplied password if the supplied user name did not exist. This ...

oval:org.secpod.oval:def:502011
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid character ...

oval:org.secpod.oval:def:1600518
It was discovered that the code that parsed the HTTP request line permittedinvalid characters. This could be exploited, in conjunction with a proxy thatalso permitted the invalid characters but with a different interpretation, toinject data into the HTTP response. By manipulating the HTTP response t ...

oval:org.secpod.oval:def:602700
Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution. As part of this update, several regressions stemming from inc ...

oval:org.secpod.oval:def:1901346
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

oval:org.secpod.oval:def:602701
Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution. As part of this update, several regressions stemming from inc ...

oval:org.secpod.oval:def:501993
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. Security Fix: * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid character ...

oval:org.secpod.oval:def:1900516
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reachJMX ports. The issue exists because this listener wasn"t updated for consistency with ...

oval:org.secpod.oval:def:1900514
When a Security Manager is configured, a web application"s ability to readsystem properties should be controlled by the Security Manager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configura ...

oval:org.secpod.oval:def:46882
The host is installed with Apache Tomcat 6.x to 6.0.47, 7.x to 7.0.72, 8.x to 8.0.38, 8.5.x to 8.5.6 or 9.x before 9.0.0.M12 and is prone to a remote code execution vulnerability. A flaw is present in the JmxRemoteLifecycleListener component. Successful exploitation allows attackers to reach JMX por ...

oval:org.secpod.oval:def:1501829
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:1501959
The advisory is missing the security advisory description. For more information please visit the reference link

oval:org.secpod.oval:def:46899
The host is installed with Apache Tomcat 8.5.x before 8.5.5, 8.0.x before 8.0.37, 6.x before 6.0.46, 7.x before 7.0.71 or 9.x before 9.0.0.M10 and is prone to a security bypass vulnerability. A flaw is present in the application which fails to handle the system property replacement feature for conf ...

oval:org.secpod.oval:def:46898
The host is installed with Apache Tomcat 8.5.x before 8.5.5, 8.0.x before 8.0.37, 6.x before 6.0.46, 7.x before 7.0.71 or 9.x before 9.0.0.M10 and is prone to an information disclosure vulnerability. A flaw is present in the application which fails to handle supplied password if the supplied user na ...

oval:org.secpod.oval:def:1600484
CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

oval:org.secpod.oval:def:1600482
CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

oval:org.secpod.oval:def:1600480
CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

oval:org.secpod.oval:def:1600473
It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. A malicious web applic ...

oval:org.secpod.oval:def:602679
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in possible timing attacks to determine valid user names, bypass of the SecurityManager, disclosure of system properties, unrestricted access to global resources, arbitrary file overwrites, ...

oval:org.secpod.oval:def:602677
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in possible timing attacks to determine valid user names, bypass of the SecurityManager, disclosure of system properties, unrestricted access to global resources, arbitrary file overwrites, ...

oval:org.secpod.oval:def:45289
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

oval:org.secpod.oval:def:45287
The host is installed with Apache Tomcat 7.x before 7.0.81 and is prone to a security bypass vulnerability. A flaw is present in the application, which fails to properly handle a specially crafted request. Successful exploitation allows attackers to bypass security constraints and/or view the source ...

oval:org.secpod.oval:def:45290
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

oval:org.secpod.oval:def:704098
tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine Several security issues were fixed in Tomcat.

CVE    53
CVE-2011-1184
CVE-2011-1088
CVE-2011-1419
CVE-2011-1475
...
*CPE
cpe:/a:apache:tomcat:7.0.7

© SecPod Technologies