org.apache.tomcat.embed:tomcat-embed-core (Maven)
Advisories
280
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 11.0.25 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>11.0.25</version></dependency>gradle
implementation("org.apache.tomcat.embed:tomcat-embed-core:11.0.25")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 7.0.0, <= 7.0.109 | No fix yet |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 11.0.0-M1, < 11.0.25 | 11.0.25 |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 10.1.0-M1, < 10.1.58 | 10.1.58 |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 9.0.0-M1, < 9.0.121 | 9.0.121 |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 10.1.0-M1, < 10.1.58 | 10.1.58 |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 7.0.30, <= 7.0.109 | No fix yet |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 9.0.0.M1, < 9.0.121 | 9.0.121 |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 11.0.0-M1, < 11.0.25 | 11.0.25 |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation |
Critical EPSS 0.75% |
>= 10.1.53, < 10.1.59 | 10.1.59 |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation |
Critical EPSS 0.75% |
>= 9.0.115, < 9.0.121 | 9.0.121 |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation |
Critical EPSS 0.75% |
>= 11.0.20, < 11.0.25 | 11.0.25 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 9.0.0-M1, < 9.0.121 | 9.0.121 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 10.1.0-M1, < 10.1.58 | 10.1.58 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 11.0.0-M1, < 11.0.25 | 11.0.25 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 7.0.0, <= 7.0.109 | No fix yet |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied |
Critical EPSS 1.22% |
< 9.0.118 | 9.0.118 |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied |
Critical EPSS 1.22% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied |
Critical EPSS 1.22% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time |
Low EPSS 0.35% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time |
Low EPSS 0.35% |
< 9.0.118 | 9.0.118 |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time |
Low EPSS 0.35% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive |
High EPSS 0.50% |
< 9.0.118 | 9.0.118 |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive |
High EPSS 0.50% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive |
High EPSS 0.50% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user |
Critical EPSS 1.33% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user |
Critical EPSS 1.33% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user |
Critical EPSS 1.33% |
< 9.0.118 | 9.0.118 |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure |
High EPSS 0.65% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure |
High EPSS 0.65% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure |
High EPSS 0.65% |
< 9.0.118 | 9.0.118 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 8.5.0, < 9.0.118 | 9.0.118 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling |
High EPSS 0.84% |
< 9.0.118 | 9.0.118 |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling |
High EPSS 0.84% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling |
High EPSS 0.84% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File |
High EPSS 0.45% |
>= 10.1.0-M1, < 10.1.54 | 10.1.54 |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File |
High EPSS 0.45% |
>= 11.0.0-M1, < 11.0.21 | 11.0.21 |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File |
High EPSS 0.45% |
>= 9.0.13, < 9.0.117 | 9.0.117 |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve |
High EPSS 0.46% |
>= 10.1.0-M1, < 10.1.54 | 10.1.54 |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve |
High EPSS 0.46% |
>= 9.0.40, < 9.0.116 | 9.0.116 |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve |
High EPSS 0.46% |
>= 11.0.0-M1, < 11.0.21 | 11.0.21 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 11.0.15, < 11.0.20 | 11.0.20 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 9.0.113, < 9.0.116 | 9.0.116 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 10.1.50, < 10.1.53 | 10.1.53 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 9.0.114, < 9.0.116 | 9.0.116 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 11.0.16, < 11.0.20 | 11.0.20 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 10.1.51, < 10.1.53 | 10.1.53 |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability |
Medium EPSS 0.53% |
>= 11.0.0-M1, < 11.0.20 | 11.0.20 |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability |
Medium EPSS 0.53% |
>= 8.5.30, < 9.0.116 | 9.0.116 |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability |
Medium EPSS 0.53% |
>= 10.1.0-M1, < 10.1.53 | 10.1.53 |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability |
High EPSS 0.70% |
>= 10.1.0-M1, < 10.1.52 | 10.1.52 |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability |
High EPSS 0.70% |
>= 11.0.0-M1, < 11.0.20 | 11.0.20 |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability |
High EPSS 0.70% |
>= 7.0.0, < 9.0.116 | 9.0.116 |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability |
High EPSS 0.57% |
>= 11.0.0-M1, < 11.0.18 | 11.0.18 |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability |
High EPSS 0.57% |
>= 9.0.83, < 9.0.115 | 9.0.115 |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability |
High EPSS 0.57% |
>= 10.1.0-M7, < 10.1.52 | 10.1.52 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 11.0.0-M1, < 11.0.15 | 11.0.15 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 10.1.0-M1, < 10.1.50 | 10.1.50 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 9.0.0-M1, < 9.0.113 | 9.0.113 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 11.0.0-M1, < 11.0.12 | 11.0.12 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 10.1.0-M1, < 10.1.47 | 10.1.47 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 9.0.0.M1, < 9.0.110 | 9.0.110 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 8.5.60, <= 8.5.100 | No fix yet |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 11.0.0-M1, < 11.0.11 | 11.0.11 |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 10.1.0-M1, < 10.1.45 | 10.1.45 |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 9.0.40, < 9.0.109 | 9.0.109 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 9.0.0-M11, < 9.0.109 | 9.0.109 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 11.0.0-M1, < 11.0.11 | 11.0.11 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 10.1.0-M1, < 10.1.45 | 10.1.45 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 8.5.6, <= 8.5.100 | No fix yet |
| GHSA-23hv-mwm6-g8jf Apache Tomcat Session Fixation vulnerability |
Medium EPSS 0.86% |
>= 10.1.0-M1, < 10.1.42 | 10.1.42 |
| GHSA-23hv-mwm6-g8jf Apache Tomcat Session Fixation vulnerability |
Medium EPSS 0.86% |
>= 11.0.0-M1, < 11.0.8 | 11.0.8 |
| GHSA-23hv-mwm6-g8jf Apache Tomcat Session Fixation vulnerability |
Medium EPSS 0.86% |
>= 9.0.0.M1, < 9.0.106 | 9.0.106 |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability |
High EPSS 3.69% |
>= 11.0.0-M1, < 11.0.10 | 11.0.10 |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability |
High EPSS 3.69% |
>= 10.1.0-M1, < 10.1.44 | 10.1.44 |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability |
High EPSS 3.69% |
>= 9.0.0.M1, < 9.0.108 | 9.0.108 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 9.0.0.M1, < 9.0.107 | 9.0.107 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 11.0.0-M1, < 11.0.9 | 11.0.9 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 10.1.0-M1, < 10.1.43 | 10.1.43 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-wr62-c79q-cv37 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits |
High EPSS 2.20% |
>= 11.0.0-M1, < 11.0.9 | 11.0.9 |
| GHSA-wr62-c79q-cv37 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits |
High EPSS 2.20% |
>= 9.0.0.M1, < 9.0.107 | 9.0.107 |
| GHSA-wr62-c79q-cv37 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits |
High EPSS 2.20% |
>= 10.1.0-M1, < 10.1.43 | 10.1.43 |
| GHSA-wr62-c79q-cv37 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits |
High EPSS 2.20% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-4j3c-42xv-3f84 Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector |
High EPSS 2.07% |
>= 9.0.0.M1, < 9.0.107 | 9.0.107 |
| GHSA-4j3c-42xv-3f84 Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector |
High EPSS 2.07% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-wc4r-xq3c-5cf3 Apache Tomcat - Security constraint bypass for pre/post-resources |
High EPSS 3.44% |
>= 10.1.0-M1, < 10.1.42 | 10.1.42 |
| GHSA-wc4r-xq3c-5cf3 Apache Tomcat - Security constraint bypass for pre/post-resources |
High EPSS 3.44% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-wc4r-xq3c-5cf3 Apache Tomcat - Security constraint bypass for pre/post-resources |
High EPSS 3.44% |
>= 9.0.0.M1, < 9.0.106 | 9.0.106 |
| GHSA-wc4r-xq3c-5cf3 Apache Tomcat - Security constraint bypass for pre/post-resources |
High EPSS 3.44% |
>= 11.0.0-M1, < 11.0.8 | 11.0.8 |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability |
High EPSS 0.36% |
>= 11.0.0-M1, < 11.0.8 | 11.0.8 |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability |
High EPSS 0.36% |
>= 9.0.23, < 9.0.106 | 9.0.106 |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability |
High EPSS 0.36% |
>= 10.1.0, < 10.1.42 | 10.1.42 |
| GHSA-h3gc-qfqq-6h8f Apache Tomcat - DoS in multipart upload |
High EPSS 30.43% |
>= 9.0.0.M1, < 9.0.106 | 9.0.106 |
| GHSA-h3gc-qfqq-6h8f Apache Tomcat - DoS in multipart upload |
High EPSS 30.43% |
>= 10.1.0-M1, < 10.1.42 | 10.1.42 |
| GHSA-h3gc-qfqq-6h8f Apache Tomcat - DoS in multipart upload |
High EPSS 30.43% |
>= 11.0.0-M1, < 11.0.8 | 11.0.8 |
| GHSA-h3gc-qfqq-6h8f Apache Tomcat - DoS in multipart upload |
High EPSS 30.43% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-h2fw-rfh5-95r3 Apache Tomcat - CGI security constraint bypass |
High EPSS 3.14% |
>= 9.0.0.M1, < 9.0.105 | 9.0.105 |
| GHSA-h2fw-rfh5-95r3 Apache Tomcat - CGI security constraint bypass |
High EPSS 3.14% |
>= 11.0.0-M1, < 11.0.7 | 11.0.7 |
| GHSA-h2fw-rfh5-95r3 Apache Tomcat - CGI security constraint bypass |
High EPSS 3.14% |
>= 10.1.0-M1, < 10.1.41 | 10.1.41 |
| GHSA-h2fw-rfh5-95r3 Apache Tomcat - CGI security constraint bypass |
High EPSS 3.14% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-ff77-26x5-69cr Apache Tomcat Rewrite rule bypass |
Critical EPSS 4.26% |
>= 10.1.10, < 10.1.40 | 10.1.40 |
| GHSA-ff77-26x5-69cr Apache Tomcat Rewrite rule bypass |
Critical EPSS 4.26% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-ff77-26x5-69cr Apache Tomcat Rewrite rule bypass |
Critical EPSS 4.26% |
>= 9.0.76, < 9.0.104 | 9.0.104 |
| GHSA-ff77-26x5-69cr Apache Tomcat Rewrite rule bypass |
Critical EPSS 4.26% |
>= 11.0.0-M2, < 11.0.6 | 11.0.6 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 9.0.76, < 9.0.104 | 9.0.104 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 10.1.10, < 10.1.40 | 10.1.40 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 11.0.0-M2, < 11.0.6 | 11.0.6 |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 11.0.0-M1, < 11.0.3 | 11.0.3 |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 10.1.0-M1, < 10.1.35 | 10.1.35 |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 9.0.0.M1, < 9.0.99 | 9.0.99 |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 10.1.0-M1, < 10.1.35 | 10.1.35 |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 9.0.0.M1, < 9.0.99 | 9.0.99 |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Known exploited |
Critical EPSS 99.94% |
>= 11.0.0-M1, < 11.0.3 | 11.0.3 |
| GHSA-27hp-xhwr-wr2m Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 8.97% |
>= 9.0.0.M1, < 9.0.98 | 9.0.98 |
| GHSA-27hp-xhwr-wr2m Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 8.97% |
>= 10.1.0-M1, < 10.1.34 | 10.1.34 |
| GHSA-27hp-xhwr-wr2m Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 8.97% |
>= 11.0.0-M1, < 11.0.2 | 11.0.2 |
| GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 31.82% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 31.82% |
>= 9.0.0.M1, < 9.0.98 | 9.0.98 |
| GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 31.82% |
>= 10.1.0-M1, < 10.1.34 | 10.1.34 |
| GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Critical EPSS 31.82% |
>= 11.0.0-M1, < 11.0.2 | 11.0.2 |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up |
Medium EPSS 2.10% |
>= 9.0.92, < 9.0.96 | 9.0.96 |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up |
Medium EPSS 2.10% |
>= 11.0.0-M23, < 11.0.0 | 11.0.0 |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up |
Medium EPSS 2.10% |
>= 10.1.27, < 10.1.31 | 10.1.31 |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 9.0.13, < 9.0.90 | 9.0.90 |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 8.5.35, <= 8.5.100 | No fix yet |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 7.0.92, <= 7.0.109 | No fix yet |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 11.0.0-M1, < 11.0.0-M21 | 11.0.0-M21 |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 10.1.0-M1, < 10.1.25 | 10.1.25 |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 11.0.0-M1, < 11.0.0-M21 | 11.0.0-M21 |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 10.1.0-M1, < 10.1.25 | 10.1.25 |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 9.0.0-M1, < 9.0.90 | 9.0.90 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 10.1.0-M1, < 10.1.19 | 10.1.19 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 9.0.0-M1, < 9.0.86 | 9.0.86 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 8.5.0, < 8.5.99 | 8.5.99 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 11.0.0-M1, < 11.0.0-M17 | 11.0.0-M17 |
| GHSA-f4qf-m5gf-8jm8 Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information |
Medium EPSS 14.29% |
>= 8.5.7, < 8.5.64 | 8.5.64 |
| GHSA-f4qf-m5gf-8jm8 Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information |
Medium EPSS 14.29% |
>= 9.0.0-M11, < 9.0.44 | 9.0.44 |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability |
High EPSS 2.65% |
>= 11.0.0-M1, < 11.0.0-M11 | 11.0.0-M11 |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability |
High EPSS 2.65% |
>= 8.5.0, < 8.5.96 | 8.5.96 |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability |
High EPSS 2.65% |
>= 9.0.0-M1, < 9.0.83 | 9.0.83 |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability |
High EPSS 2.65% |
>= 10.1.0-M1, < 10.1.16 | 10.1.16 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 10.1.0-M1, < 10.1.14 | 10.1.14 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 9.0.0-M1, < 9.0.81 | 9.0.81 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 9.0.0-M1, < 9.0.81 | 9.0.81 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 10.1.0-M1, < 10.1.14 | 10.1.14 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 9.0.0, < 9.0.81 | 9.0.81 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 10.0.0, < 10.1.14 | 10.1.14 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 9.0.0, < 9.0.81 | 9.0.81 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 10.0.0, < 10.1.14 | 10.1.14 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 9.0.0-M1, < 9.0.80 | 9.0.80 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 10.1.0-M1, < 10.1.13 | 10.1.13 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 8.5.0, < 8.5.93 | 8.5.93 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 11.0.0-M1, < 11.0.0-M11 | 11.0.0-M11 |
| GHSA-mppv-79ch-vw6q Apache Tomcat vulnerable to information leak |
High EPSS 1.12% |
>= 10.1.8, < 10.1.9 | 10.1.9 |
| GHSA-mppv-79ch-vw6q Apache Tomcat vulnerable to information leak |
High EPSS 1.12% |
>= 11.0.0-M5, < 11.0.0-M6 | 11.0.0-M6 |
| GHSA-mppv-79ch-vw6q Apache Tomcat vulnerable to information leak |
High EPSS 1.12% |
>= 9.0.74, < 9.0.75 | 9.0.75 |
| GHSA-cx6h-86xw-9x34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete |
High EPSS 48.03% |
>= 11.0.0-M2, < 11.0.0-M5 | 11.0.0-M5 |
| GHSA-cx6h-86xw-9x34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete |
High EPSS 48.03% |
>= 10.1.5, < 10.1.8 | 10.1.8 |
| GHSA-cx6h-86xw-9x34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete |
High EPSS 48.03% |
>= 9.0.71, < 9.0.74 | 9.0.74 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 11.0.0-M2, < 11.0.0-M5 | 11.0.0-M5 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 9.0.0-M1, < 9.0.71 | 9.0.71 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 8.5.85, < 8.5.88 | 8.5.88 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 10.1.0-M1, < 10.1.5 | 10.1.5 |
| GHSA-rq2w-37h9-vg94 Apache Tomcat improperly escapes input from JsonErrorReportValve |
High EPSS 2.57% |
>= 9.0.40, < 9.0.69 | 9.0.69 |
| GHSA-rq2w-37h9-vg94 Apache Tomcat improperly escapes input from JsonErrorReportValve |
High EPSS 2.57% |
>= 10.1.0, < 10.1.2 | 10.1.2 |
| GHSA-rq2w-37h9-vg94 Apache Tomcat improperly escapes input from JsonErrorReportValve |
High EPSS 2.57% |
>= 8.5.83, < 8.5.84 | 8.5.84 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 10.0.0-M1, < 10.0.27 | 10.0.27 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 8.5.0, < 8.5.83 | 8.5.83 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 9.0.0-M1, < 9.0.68 | 9.0.68 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 10.1.0-M1, < 10.1.1 | 10.1.1 |
| GHSA-wf5v-jhxj-q632 Denial of service in Apache Tomcat |
Medium EPSS 8.49% |
>= 8.0.0-RC1, < 8.0.4 | 8.0.4 |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 8.5.0, <= 8.5.22 | No fix yet |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 7.0.0, <= 7.0.81 | No fix yet |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 8.0.0-RC1, <= 8.0.46 | No fix yet |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 8.5.0, < 8.5.23 | 8.5.23 |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 8.0.0-RC1, < 8.0.47 | 8.0.47 |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 7.0.0, < 7.0.82 | 7.0.82 |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 9.0.0.M1, <= 9.0.0M27 | No fix yet |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat Known exploited |
High EPSS 99.97% |
>= 9.0.0.M1, < 9.0.1 | 9.0.1 |
| GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat |
Critical EPSS 7.75% |
>= 9.0.0.M1, < 9.0.0.M19 | 9.0.0.M19 |
| GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat |
Critical EPSS 7.75% |
>= 8.5.0, < 8.5.13 | 8.5.13 |
| GHSA-3vx3-xf6q-r5xp Exposure of Resource to Wrong Sphere in Apache Tomcat |
Critical EPSS 13.23% |
>= 9.0.0.M1, < 9.0.0.M18 | 9.0.0.M18 |
| GHSA-3vx3-xf6q-r5xp Exposure of Resource to Wrong Sphere in Apache Tomcat |
Critical EPSS 13.23% |
>= 8.5.0, < 8.5.13 | 8.5.13 |
| GHSA-3vx3-xf6q-r5xp Exposure of Resource to Wrong Sphere in Apache Tomcat |
Critical EPSS 13.23% |
>= 7.0.0, < 7.0.76 | 7.0.76 |
| GHSA-3vx3-xf6q-r5xp Exposure of Resource to Wrong Sphere in Apache Tomcat |
Critical EPSS 13.23% |
>= 8.0.0, < 8.0.42 | 8.0.42 |
| GHSA-f98p-9pp6-7q6c Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 9.78% |
>= 5.5.9, < 5.5.27 | 5.5.27 |
| GHSA-f98p-9pp6-7q6c Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 9.78% |
>= 6.0.0, < 6.0.18 | 6.0.18 |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 26.70% |
>= 10.0.0-M1, < 10.0.0-M5 | 10.0.0-M5 |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 26.70% |
>= 8.5.0, < 8.5.55 | 8.5.55 |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 26.70% |
>= 9.0.0.M1, < 9.0.35 | 9.0.35 |
| GHSA-j39c-c8hj-x4j3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 18.11% |
>= 10.0.0-M1, < 10.0.2 | 10.0.2 |
| GHSA-j39c-c8hj-x4j3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 18.11% |
>= 9.0.0-M1, < 9.0.43 | 9.0.43 |
| GHSA-j39c-c8hj-x4j3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 18.11% |
>= 8.5.0, < 8.5.63 | 8.5.63 |
| GHSA-2rvv-w9r2-rg7m Information Disclosure in Apache Tomcat |
Medium EPSS 22.85% |
>= 10.0.0-M1, < 10.0.0-M10 | 10.0.0-M10 |
| GHSA-2rvv-w9r2-rg7m Information Disclosure in Apache Tomcat |
Medium EPSS 22.85% |
>= 7.0.0, < 7.0.107 | 7.0.107 |
| GHSA-2rvv-w9r2-rg7m Information Disclosure in Apache Tomcat |
Medium EPSS 22.85% |
>= 8.5.0, < 8.5.60 | 8.5.60 |
| GHSA-2rvv-w9r2-rg7m Information Disclosure in Apache Tomcat |
Medium EPSS 22.85% |
>= 9.0.0, < 9.0.40 | 9.0.40 |
| GHSA-jgwr-3qm3-26f3 Potential remote code execution in Apache Tomcat |
High EPSS 9.49% |
>= 10.0.0-M1, < 10.0.2 | 10.0.2 |
| GHSA-jgwr-3qm3-26f3 Potential remote code execution in Apache Tomcat |
High EPSS 9.49% |
>= 7.0.0, < 7.0.108 | 7.0.108 |
| GHSA-jgwr-3qm3-26f3 Potential remote code execution in Apache Tomcat |
High EPSS 9.49% |
>= 8.0.0, < 8.5.61 | 8.5.61 |
| GHSA-jgwr-3qm3-26f3 Potential remote code execution in Apache Tomcat |
High EPSS 9.49% |
>= 9.0.0, < 9.0.41 | 9.0.41 |
| GHSA-qcxh-w3j9-58qr Apache Tomcat Denial of Service vulnerability |
High EPSS 72.86% |
>= 8.0.0, < 8.5.38 | 8.5.38 |
| GHSA-qcxh-w3j9-58qr Apache Tomcat Denial of Service vulnerability |
High EPSS 72.86% |
>= 9.0.0, < 9.0.16 | 9.0.16 |
| GHSA-344f-f5vg-2jfj Potential remote code execution in Apache Tomcat |
High EPSS 55.52% |
>= 8.0.0, < 8.5.55 | 8.5.55 |
| GHSA-344f-f5vg-2jfj Potential remote code execution in Apache Tomcat |
High EPSS 55.52% |
>= 10.0.0-M1, < 10.0.0-M5 | 10.0.0-M5 |
| GHSA-344f-f5vg-2jfj Potential remote code execution in Apache Tomcat |
High EPSS 55.52% |
>= 9.0.0, < 9.0.35 | 9.0.35 |
| GHSA-344f-f5vg-2jfj Potential remote code execution in Apache Tomcat |
High EPSS 55.52% |
>= 7.0.0, < 7.0.104 | 7.0.104 |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 8.87% |
>= 9.0.28, < 9.0.31 | 9.0.31 |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 8.87% |
>= 8.5.48, < 8.5.51 | 8.5.51 |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 8.87% |
>= 7.0.98, < 7.0.100 | 7.0.100 |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 9.39% |
< 7.0.100 | 7.0.100 |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 9.39% |
>= 9.0.0, < 9.0.31 | 9.0.31 |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 9.39% |
>= 8.0.0, < 8.5.51 | 8.5.51 |
| CVE-2020-1938 Improper Privilege Management in Tomcat Known exploited |
Critical EPSS 99.27% |
>= 9.0.0, < 9.0.31 | 9.0.31 |
| CVE-2020-1938 Improper Privilege Management in Tomcat Known exploited |
Critical EPSS 99.27% |
>= 8.0.0, < 8.5.51 | 8.5.51 |
| CVE-2020-1938 Improper Privilege Management in Tomcat Known exploited |
Critical EPSS 99.27% |
>= 7.0.0, < 7.0.100 | 7.0.100 |
| CVE-2020-1938 Improper Privilege Management in Tomcat Known exploited |
Critical EPSS 99.27% |
>= 9.0.0, < 9.0.31 | 9.0.31 |
| CVE-2020-1938 Improper Privilege Management in Tomcat Known exploited |
Critical EPSS 99.27% |
>= 7.0.0, < 7.0.100 | 7.0.100 |
| CVE-2020-1938 Improper Privilege Management in Tomcat Known exploited |
Critical EPSS 99.27% |
>= 8.0.0, < 8.5.51 | 8.5.51 |
| GHSA-hh3j-x4mc-g48r Insufficiently Protected Credentials in Apache Tomcat |
High EPSS 1.22% |
< 7.0.99 | 7.0.99 |
| GHSA-hh3j-x4mc-g48r Insufficiently Protected Credentials in Apache Tomcat |
High EPSS 1.22% |
>= 8.0.0, < 8.5.49 | 8.5.49 |
| GHSA-hh3j-x4mc-g48r Insufficiently Protected Credentials in Apache Tomcat |
High EPSS 1.22% |
>= 9.0.0, < 9.0.29 | 9.0.29 |
| GHSA-9xcj-c8cr-8c3c In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack |
High EPSS 10.69% |
>= 8.0.0, < 8.5.50 | 8.5.50 |
| GHSA-9xcj-c8cr-8c3c In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack |
High EPSS 10.69% |
>= 9.0.0, < 9.0.30 | 9.0.30 |
| GHSA-9xcj-c8cr-8c3c In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack |
High EPSS 10.69% |
< 7.0.99 | 7.0.99 |
| GHSA-q4hg-rmq2-52q9 Improper Locking in Apache Tomcat |
High EPSS 72.99% |
>= 9.0.0.M1, < 9.0.20 | 9.0.20 |
| GHSA-q4hg-rmq2-52q9 Improper Locking in Apache Tomcat |
High EPSS 72.99% |
>= 8.5.0, < 8.5.41 | 8.5.41 |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat |
Medium EPSS 59.19% |
>= 9.0.0, < 9.0.17 | 9.0.17 |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat |
Medium EPSS 59.19% |
>= 7.0.0, < 7.0.94 | 7.0.94 |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat |
Medium EPSS 59.19% |
>= 8.5.0, < 8.5.40 | 8.5.40 |
| GHSA-r53m-pfr5-7v87 Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core Withdrawn |
Medium | >= 9.0.0.M1, < 9.0.16 | 9.0.16 |
| GHSA-r53m-pfr5-7v87 Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core Withdrawn |
Medium | >= 8.5.0, < 8.5.38 | 8.5.38 |
| GHSA-8vmx-qmch-mpqg Apache Tomcat OS Command Injection vulnerability |
High EPSS 99.92% |
>= 9.0.0.M1, < 9.0.17 | 9.0.17 |
| GHSA-8vmx-qmch-mpqg Apache Tomcat OS Command Injection vulnerability |
High EPSS 99.92% |
>= 8.0.0, < 8.5.40 | 8.5.40 |
| GHSA-8vmx-qmch-mpqg Apache Tomcat OS Command Injection vulnerability |
High EPSS 99.92% |
>= 7.0.0, < 7.0.94 | 7.0.94 |
| GHSA-6v52-mj5r-7j2m Apache Tomcat Race Condition vulnerability |
Medium EPSS 11.16% |
>= 8.5.5, < 8.5.32 | 8.5.32 |
| GHSA-6v52-mj5r-7j2m Apache Tomcat Race Condition vulnerability |
Medium EPSS 11.16% |
>= 9.0.0.M9, < 9.0.10 | 9.0.10 |
| GHSA-46j3-r4pj-4835 The host name verification missing in Apache Tomcat |
High EPSS 21.05% |
>= 8.0.0, < 8.0.53 | 8.0.53 |
| GHSA-46j3-r4pj-4835 The host name verification missing in Apache Tomcat |
High EPSS 21.05% |
>= 8.5.0, < 8.5.32 | 8.5.32 |
| GHSA-46j3-r4pj-4835 The host name verification missing in Apache Tomcat |
High EPSS 21.05% |
>= 9.0.0, < 9.0.10 | 9.0.10 |
| GHSA-46j3-r4pj-4835 The host name verification missing in Apache Tomcat |
High EPSS 21.05% |
>= 7.0.35, < 7.0.90 | 7.0.90 |
| GHSA-r4x2-3cq5-hqvp The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins |
Critical EPSS 20.94% |
>= 8.0.0RC1, < 8.0.53 | 8.0.53 |
| GHSA-r4x2-3cq5-hqvp The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins |
Critical EPSS 20.94% |
>= 7.0.41, < 7.0.88 | 7.0.88 |
| GHSA-r4x2-3cq5-hqvp The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins |
Critical EPSS 20.94% |
>= 9.0.0.M1, < 9.0.9 | 9.0.9 |
| GHSA-r4x2-3cq5-hqvp The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins |
Critical EPSS 20.94% |
>= 8.5.0, < 8.5.32 | 8.5.32 |
| GHSA-m59c-jpc8-m2x4 In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder |
High EPSS 20.35% |
>= 8.0.0RC1, < 8.0.51 | 8.0.51 |
| GHSA-m59c-jpc8-m2x4 In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder |
High EPSS 20.35% |
>= 7.0.28, < 7.0.87 | 7.0.87 |
| GHSA-m59c-jpc8-m2x4 In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder |
High EPSS 20.35% |
>= 9.0.0.M9, < 9.0.8 | 9.0.8 |
| GHSA-m59c-jpc8-m2x4 In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder |
High EPSS 20.35% |
>= 8.5.0, < 8.5.31 | 8.5.31 |
| GHSA-jx6h-3fjx-cgv5 Apache Tomcat information exposure vulnerability |
Medium EPSS 14.47% |
>= 7.0.0, < 7.0.85 | 7.0.85 |
| GHSA-jx6h-3fjx-cgv5 Apache Tomcat information exposure vulnerability |
Medium EPSS 14.47% |
>= 8.5.0, < 8.5.28 | 8.5.28 |
| GHSA-jx6h-3fjx-cgv5 Apache Tomcat information exposure vulnerability |
Medium EPSS 14.47% |
>= 9.0.0M1, < 9.0.5 | 9.0.5 |
| GHSA-6rxj-58jh-436r Apache Tomcat unauthorized access vulnerability |
Medium EPSS 17.07% |
>= 8.0.0, < 8.0.51 | 8.0.51 |
| GHSA-6rxj-58jh-436r Apache Tomcat unauthorized access vulnerability |
Medium EPSS 17.07% |
>= 8.5.0, < 8.5.28 | 8.5.28 |
| GHSA-6rxj-58jh-436r Apache Tomcat unauthorized access vulnerability |
Medium EPSS 17.07% |
>= 7.0.0, < 7.0.86 | 7.0.86 |
| GHSA-6rxj-58jh-436r Apache Tomcat unauthorized access vulnerability |
Medium EPSS 17.07% |
>= 9.0.0, < 9.0.5 | 9.0.5 |
| GHSA-5q99-f34m-67gc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 97.68% |
>= 8.5.0, < 8.5.34 | 8.5.34 |
| GHSA-5q99-f34m-67gc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 97.68% |
>= 7.0.23, < 7.0.91 | 7.0.91 |
| GHSA-5q99-f34m-67gc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 97.68% |
>= 9.0.0, < 9.0.12 | 9.0.12 |
| GHSA-pjfr-qf3p-3q25 When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server Known exploited |
High EPSS 99.71% |
>= 7.0.0, < 7.0.79 | 7.0.79 |
| GHSA-pjfr-qf3p-3q25 When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server Known exploited |
High EPSS 99.71% |
>= 7.0.0, < 7.0.79 | 7.0.79 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor