org.apache.tomcat:tomcat (Maven)
Advisories
437
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 11.0.25 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat</artifactId><version>11.0.25</version></dependency>gradle
implementation("org.apache.tomcat:tomcat:11.0.25")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 7.0.0, <= 7.0.109 | No fix yet |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 11.0.0-M1, < 11.0.25 | 11.0.25 |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 10.1.0-M1, < 10.1.58 | 10.1.58 |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 9.0.0-M1, < 9.0.121 | 9.0.121 |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability |
Critical EPSS 0.64% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 10.1.0-M1, < 10.1.58 | 10.1.58 |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 11.0.0-M1, < 11.0.25 | 11.0.25 |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 7.0.30, <= 7.0.109 | No fix yet |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability |
Critical EPSS 0.76% |
>= 9.0.0.M1, < 9.0.121 | 9.0.121 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 10.1.0-M1, < 10.1.58 | 10.1.58 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 11.0.0-M1, < 11.0.25 | 11.0.25 |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 7.0.0, <= 7.0.109 | No fix yet |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability |
Critical EPSS 0.65% |
>= 9.0.0-M1, < 9.0.121 | 9.0.121 |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied |
Critical EPSS 1.22% |
< 9.0.118 | 9.0.118 |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied |
Critical EPSS 1.22% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied |
Critical EPSS 1.22% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time |
Low EPSS 0.35% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time |
Low EPSS 0.35% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time |
Low EPSS 0.35% |
< 9.0.118 | 9.0.118 |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive |
High EPSS 0.50% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive |
High EPSS 0.50% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive |
High EPSS 0.50% |
< 9.0.118 | 9.0.118 |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user |
Critical EPSS 1.33% |
< 9.0.118 | 9.0.118 |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user |
Critical EPSS 1.33% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user |
Critical EPSS 1.33% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure |
High EPSS 0.65% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure |
High EPSS 0.65% |
< 9.0.118 | 9.0.118 |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure |
High EPSS 0.65% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 8.5.0, < 9.0.118 | 9.0.118 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling |
High EPSS 0.84% |
< 9.0.118 | 9.0.118 |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling |
High EPSS 0.84% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling |
High EPSS 0.84% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File |
High EPSS 0.45% |
>= 10.1.0-M1, < 10.1.54 | 10.1.54 |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File |
High EPSS 0.45% |
>= 11.0.0-M1, < 11.0.21 | 11.0.21 |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File |
High EPSS 0.45% |
>= 9.0.13, < 9.0.117 | 9.0.117 |
| GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability Known exploited |
High EPSS 98.50% |
No fix yet | |
| GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability Known exploited |
High EPSS 98.50% |
No fix yet | |
| GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability Known exploited |
High EPSS 98.50% |
No fix yet | |
| GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability Known exploited |
High EPSS 98.50% |
>= 9.0.116, < 9.0.117 | 9.0.117 |
| GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability Known exploited |
High EPSS 98.50% |
>= 10.1.53, < 10.1.54 | 10.1.54 |
| GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability Known exploited |
High EPSS 98.50% |
>= 11.0.20, < 11.0.21 | 11.0.21 |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve |
High EPSS 0.46% |
>= 10.1.0-M1, < 10.1.54 | 10.1.54 |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve |
High EPSS 0.46% |
>= 11.0.0-M1, < 11.0.21 | 11.0.21 |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve |
High EPSS 0.46% |
>= 9.0.40, < 9.0.116 | 9.0.116 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 11.0.15, < 11.0.20 | 11.0.20 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 10.1.50, < 10.1.53 | 10.1.53 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 9.0.113, < 9.0.116 | 9.0.116 |
| GHSA-h468-7pvh-8vr8 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor |
High EPSS 8.85% |
>= 10.1.50, < 10.1.53 | 10.1.53 |
| GHSA-h468-7pvh-8vr8 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor |
High EPSS 8.85% |
>= 11.0.0-M1, < 11.0.20 | 11.0.20 |
| GHSA-h468-7pvh-8vr8 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor |
High EPSS 8.85% |
>= 7.0.100, <= 7.0.109 | No fix yet |
| GHSA-h468-7pvh-8vr8 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor |
High EPSS 8.85% |
>= 8.5.38, <= 8.5.100 | No fix yet |
| GHSA-h468-7pvh-8vr8 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor |
High EPSS 8.85% |
>= 9.0.13, < 9.0.116 | 9.0.116 |
| GHSA-95jq-rwvf-vjx4 Apache Tomcat: CLIENT_CERT authentication does not fail as expected |
Critical EPSS 0.71% |
>= 10.1.0-M7, < 10.1.53 | 10.1.53 |
| GHSA-95jq-rwvf-vjx4 Apache Tomcat: CLIENT_CERT authentication does not fail as expected |
Critical EPSS 0.71% |
>= 11.0.0-M1, < 11.0.20 | 11.0.20 |
| GHSA-95jq-rwvf-vjx4 Apache Tomcat: CLIENT_CERT authentication does not fail as expected |
Critical EPSS 0.71% |
>= 9.0.83, < 9.0.116 | 9.0.116 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 10.1.51, < 10.1.53 | 10.1.53 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 9.0.114, < 9.0.116 | 9.0.116 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 11.0.16, < 11.0.20 | 11.0.20 |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability |
Medium EPSS 0.53% |
>= 10.1.0-M1, < 10.1.53 | 10.1.53 |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability |
Medium EPSS 0.53% |
>= 11.0.0-M1, < 11.0.20 | 11.0.20 |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability |
Medium EPSS 0.53% |
>= 8.5.30, < 9.0.116 | 9.0.116 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 9.0.0-M1, < 9.0.113 | 9.0.113 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 10.1.0-M1, < 10.1.50 | 10.1.50 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 11.0.0-M1, < 11.0.15 | 11.0.15 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 11.0.0-M1, < 11.0.12 | 11.0.12 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 9.0.0.M1, < 9.0.110 | 9.0.110 |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release |
Medium EPSS 1.25% |
>= 10.1.0-M1, < 10.1.47 | 10.1.47 |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 8.5.60, <= 8.5.100 | No fix yet |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 10.1.0-M1, < 10.1.45 | 10.1.45 |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 11.0.0-M1, < 11.0.11 | 11.0.11 |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences |
Critical EPSS 10.17% |
>= 9.0.40, < 9.0.109 | 9.0.109 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 10.1.0-M1, < 10.1.45 | 10.1.45 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 8.5.6, <= 8.5.100 | No fix yet |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 9.0.0-M11, < 9.0.109 | 9.0.109 |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal |
High EPSS 64.41% |
>= 11.0.0-M1, < 11.0.11 | 11.0.11 |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability |
High EPSS 0.36% |
>= 9.0.23, < 9.0.106 | 9.0.106 |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability |
High EPSS 0.36% |
>= 11.0.0-M1, < 11.0.8 | 11.0.8 |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability |
High EPSS 0.36% |
>= 10.1.0, < 10.1.42 | 10.1.42 |
| GHSA-653p-vg55-5652 Apache Tomcat Uncontrolled Resource Consumption vulnerability |
Medium EPSS 1.94% |
>= 10.1.0-M1, < 10.1.34 | 10.1.34 |
| GHSA-653p-vg55-5652 Apache Tomcat Uncontrolled Resource Consumption vulnerability |
Medium EPSS 1.94% |
>= 9.0.0.M1, < 9.0.98 | 9.0.98 |
| GHSA-653p-vg55-5652 Apache Tomcat Uncontrolled Resource Consumption vulnerability |
Medium EPSS 1.94% |
>= 11.0.0-M1, < 11.0.2 | 11.0.2 |
| GHSA-f632-9449-3j4w Apache Tomcat - XSS in generated JSPs |
Medium EPSS 1.88% |
>= 10.1.31, < 10.1.32 | 10.1.32 |
| GHSA-f632-9449-3j4w Apache Tomcat - XSS in generated JSPs |
Medium EPSS 1.88% |
>= 11.0.0, < 11.0.1 | 11.0.1 |
| GHSA-f632-9449-3j4w Apache Tomcat - XSS in generated JSPs |
Medium EPSS 1.88% |
>= 9.0.96, < 9.0.97 | 9.0.97 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 9.0.0-M1, < 9.0.81 | 9.0.81 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 10.1.0-M1, < 10.1.14 | 10.1.14 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 9.0.0-M1, < 9.0.81 | 9.0.81 |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.51% |
>= 10.1.0-M1, < 10.1.14 | 10.1.14 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 8.5.0, < 8.5.93 | 8.5.93 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 9.0.0-M1, < 9.0.80 | 9.0.80 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 11.0.0-M1, < 11.0.0-M11 | 11.0.0-M11 |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability |
Medium EPSS 6.46% |
>= 10.1.0-M1, < 10.1.13 | 10.1.13 |
| GHSA-jx7c-7mj5-9438 Apache Tomcat Race Condition vulnerability |
Low EPSS 2.36% |
>= 9.0.0-M1, < 9.0.62 | 9.0.62 |
| GHSA-jx7c-7mj5-9438 Apache Tomcat Race Condition vulnerability |
Low EPSS 2.36% |
>= 10.1.0-M1, < 10.1.0-M14 | 10.1.0-M14 |
| GHSA-jx7c-7mj5-9438 Apache Tomcat Race Condition vulnerability |
Low EPSS 2.36% |
>= 8.5.0, < 8.5.78 | 8.5.78 |
| GHSA-jx7c-7mj5-9438 Apache Tomcat Race Condition vulnerability |
Low EPSS 2.36% |
>= 10.0.0-M1, < 10.0.20 | 10.0.20 |
| GHSA-6j88-6whg-x687 Cross-site Scripting in Apache Tomcat |
Medium EPSS 6.71% |
>= 10.0.0-M1, < 10.0.22 | 10.0.22 |
| GHSA-6j88-6whg-x687 Cross-site Scripting in Apache Tomcat |
Medium EPSS 6.71% |
>= 10.1.0-M1, < 10.1.0-M17 | 10.1.0-M17 |
| GHSA-6j88-6whg-x687 Cross-site Scripting in Apache Tomcat |
Medium EPSS 6.71% |
>= 8.5.50, < 8.5.82 | 8.5.82 |
| GHSA-6j88-6whg-x687 Cross-site Scripting in Apache Tomcat |
Medium EPSS 6.71% |
>= 9.0.30, < 9.0.65 | 9.0.65 |
| GHSA-rp8h-vr48-4j8p Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests |
Medium EPSS 6.33% |
>= 7.0, < 7.0.22 | 7.0.22 |
| GHSA-rp8h-vr48-4j8p Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests |
Medium EPSS 6.33% |
>= 6.0.30, < 6.0.35 | 6.0.35 |
| GHSA-v6c7-8qx5-8gmp Deserialization of Untrusted Data in Apache Tomcat |
High EPSS 7.20% |
< 7.0.39 | 7.0.39 |
| GHSA-r7c8-hghc-2mp8 Apache Tomcat Allows Replacing of XML Parser |
Medium EPSS 0.84% |
>= 7.0.0, < 7.0.17 | 7.0.17 |
| GHSA-3p5r-7cw3-2m67 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Low EPSS 6.50% |
>= 7.0.0, < 7.0.40 | 7.0.40 |
| GHSA-vch7-92vf-jm44 Apache Tomcat does not follow ServletSecurity annotations |
Medium EPSS 6.54% |
>= 7.0, < 7.0.11 | 7.0.11 |
| GHSA-28cq-6rmx-pjq4 Improper Authentication in Apache Tomcat |
Medium EPSS 12.10% |
>= 5.5.0, < 5.5.36 | 5.5.36 |
| GHSA-28cq-6rmx-pjq4 Improper Authentication in Apache Tomcat |
Medium EPSS 12.10% |
>= 6.0.0, < 6.0.36 | 6.0.36 |
| GHSA-28cq-6rmx-pjq4 Improper Authentication in Apache Tomcat |
Medium EPSS 12.10% |
>= 7.0.0, < 7.0.30 | 7.0.30 |
| GHSA-h6c8-rg87-f3pc Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users |
Medium EPSS 8.69% |
>= 7.0.0, < 7.0.12 | 7.0.12 |
| GHSA-jgm2-m5cg-f66g Authentication Bypass in Apache Tomcat |
Medium EPSS 11.97% |
>= 7.0.0, < 7.0.30 | 7.0.30 |
| GHSA-jgm2-m5cg-f66g Authentication Bypass in Apache Tomcat |
Medium EPSS 11.97% |
>= 6.0.0, < 6.0.36 | 6.0.36 |
| GHSA-76vr-72mv-mf3q Cross-Site Request Forgery in Apache Tomcat |
Medium EPSS 9.15% |
>= 7.0.0, < 7.0.32 | 7.0.32 |
| GHSA-76vr-72mv-mf3q Cross-Site Request Forgery in Apache Tomcat |
Medium EPSS 9.15% |
>= 6.0.0, < 6.0.36 | 6.0.36 |
| GHSA-99rf-92v6-cwx4 Improper Access Control in Apache Tomcat |
Medium EPSS 8.98% |
>= 5.5.0, < 5.5.36 | 5.5.36 |
| GHSA-99rf-92v6-cwx4 Improper Access Control in Apache Tomcat |
Medium EPSS 8.98% |
>= 6.0.0, < 6.0.36 | 6.0.36 |
| GHSA-99rf-92v6-cwx4 Improper Access Control in Apache Tomcat |
Medium EPSS 8.98% |
>= 7.0.0, < 7.0.30 | 7.0.30 |
| GHSA-wr3m-gw98-mc3j Improper Input Validation in Apache Tomcat |
Medium EPSS 79.71% |
>= 5.5.0, < 5.5.35 | 5.5.35 |
| GHSA-wr3m-gw98-mc3j Improper Input Validation in Apache Tomcat |
Medium EPSS 79.71% |
>= 7.0.0, < 7.0.23 | 7.0.23 |
| GHSA-wr3m-gw98-mc3j Improper Input Validation in Apache Tomcat |
Medium EPSS 79.71% |
>= 6.0.0, < 6.0.35 | 6.0.35 |
| GHSA-w7cg-5969-678w Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token |
High EPSS 9.67% |
< 7.0.68 | 7.0.68 |
| GHSA-w7cg-5969-678w Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token |
High EPSS 9.67% |
>= 8.0.0, < 8.0.31 | 8.0.31 |
| GHSA-w7cg-5969-678w Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token |
High EPSS 9.67% |
>= 9.0.0.M0, < 9.0.0.M2 | 9.0.0.M2 |
| GHSA-jrcp-c39h-r29x Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
High EPSS 10.57% |
>= 7.0.0, < 7.0.66 | 7.0.66 |
| GHSA-jrcp-c39h-r29x Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
High EPSS 10.57% |
>= 8.0.0.RC1, < 8.0.31 | 8.0.31 |
| GHSA-jrcp-c39h-r29x Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
High EPSS 10.57% |
>= 9.0.0.M1, < 9.0.0.M2 | 9.0.0.M2 |
| GHSA-43v2-6grp-9pp9 Apache Tomcat does not enforce the maxHttpHeaderSize limit |
High EPSS 7.89% |
>= 6.0.0, < 6.0.32 | 6.0.32 |
| GHSA-43v2-6grp-9pp9 Apache Tomcat does not enforce the maxHttpHeaderSize limit |
High EPSS 7.89% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-mg4v-rf8p-ghqq Apache Tomcat allows remote attackers to bypass intended access restrictions |
Medium EPSS 6.45% |
>= 7.0.0, < 7.0.10 | 7.0.10 |
| GHSA-p26v-97vp-jcx6 Access controll bypass in Apache Tomcat |
Medium EPSS 6.16% |
>= 7.0.11, < 7.0.12 | 7.0.12 |
| GHSA-3xpj-jgv5-q4vv Access restriction bypass in Apache Tomcat |
Medium EPSS 6.02% |
>= 7.0.12, < 7.0.14 | 7.0.14 |
| GHSA-c78g-qwpw-2jgv Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
Medium EPSS 42.01% |
>= 6.0.12, <= 6.0.29 | No fix yet |
| GHSA-c78g-qwpw-2jgv Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
Medium EPSS 42.01% |
>= 7.0.0, < 7.0.5 | 7.0.5 |
| GHSA-pvjh-7h8q-q56r Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header |
Medium EPSS 2.14% |
>= 6.0.0, < 6.0.35 | 6.0.35 |
| GHSA-gvgc-rxmh-5hvw Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment |
Medium EPSS 23.49% |
>= 6.0.0, < 6.0.32 | 6.0.32 |
| GHSA-gvgc-rxmh-5hvw Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment |
Medium EPSS 23.49% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-gvgc-rxmh-5hvw Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment |
Medium EPSS 23.49% |
>= 5.5.0, < 5.5.33 | 5.5.33 |
| GHSA-9hjv-9h75-xmpp Improper Verification of Source of a Communication Channel in Apache Tomcat |
Medium EPSS 11.30% |
>= 7.0.0, < 7.0.68 | 7.0.68 |
| GHSA-9hjv-9h75-xmpp Improper Verification of Source of a Communication Channel in Apache Tomcat |
Medium EPSS 11.30% |
>= 9.0.0M1, < 9.0.0.M3 | 9.0.0.M3 |
| GHSA-9hjv-9h75-xmpp Improper Verification of Source of a Communication Channel in Apache Tomcat |
Medium EPSS 11.30% |
>= 8.0.0, < 8.0.32 | 8.0.32 |
| GHSA-9737-qmgc-hfr9 Directory Traversal in Apache Tomcat |
Medium EPSS 18.68% |
>= 6.0.0, < 6.0.20 | 6.0.20 |
| GHSA-9737-qmgc-hfr9 Directory Traversal in Apache Tomcat |
Medium EPSS 18.68% |
>= 5.5.0, < 5.5.28 | 5.5.28 |
| GHSA-9737-qmgc-hfr9 Directory Traversal in Apache Tomcat |
Medium EPSS 18.68% |
>= 4.1.0, < 4.1.40 | 4.1.40 |
| GHSA-9ggm-7897-x4mg Improper Input Validation in Apache Tomcat |
Medium EPSS 0.70% |
>= 6.0.0, < 6.0.33 | 6.0.33 |
| GHSA-9ggm-7897-x4mg Improper Input Validation in Apache Tomcat |
Medium EPSS 0.70% |
>= 7.0.0, < 7.0.19 | 7.0.19 |
| GHSA-9ggm-7897-x4mg Improper Input Validation in Apache Tomcat |
Medium EPSS 0.70% |
< 5.5.34 | 5.5.34 |
| GHSA-4f7h-9j2x-cmr4 Improper Authentication in Apache Tomcat |
Medium EPSS 7.36% |
>= 7.0.0, < 7.0.12 | 7.0.12 |
| GHSA-c57p-3v2g-w9rg Insertion of Sensitive Information into Log File in Apache Tomcat |
Medium EPSS 0.67% |
>= 5.5.0, < 5.5.34 | 5.5.34 |
| GHSA-c57p-3v2g-w9rg Insertion of Sensitive Information into Log File in Apache Tomcat |
Medium EPSS 0.67% |
>= 6.0.0, < 6.0.33 | 6.0.33 |
| GHSA-c57p-3v2g-w9rg Insertion of Sensitive Information into Log File in Apache Tomcat |
Medium EPSS 0.67% |
>= 7.0.0, < 7.0.19 | 7.0.19 |
| GHSA-6cr4-7c7p-p3xv Use of Hard-coded Cryptographic Key in Apache Tomcat |
Medium EPSS 6.33% |
>= 7.0.0, < 7.0.12 | 7.0.12 |
| GHSA-4f7h-9j2x-cmr4 Improper Authentication in Apache Tomcat |
Medium EPSS 7.36% |
>= 6.0.0, < 6.0.33 | 6.0.33 |
| GHSA-4f7h-9j2x-cmr4 Improper Authentication in Apache Tomcat |
Medium EPSS 7.36% |
>= 5.5.0, < 5.5.34 | 5.5.34 |
| GHSA-6cr4-7c7p-p3xv Use of Hard-coded Cryptographic Key in Apache Tomcat |
Medium EPSS 6.33% |
>= 6.0.0, < 6.0.33 | 6.0.33 |
| GHSA-cxg2-49rq-8gcr Apache Tomcat does not properly handle an invalid Transfer-Encoding header |
Medium EPSS 54.78% |
>= 7.0.0, < 7.0.2 | 7.0.2 |
| GHSA-cxg2-49rq-8gcr Apache Tomcat does not properly handle an invalid Transfer-Encoding header |
Medium EPSS 54.78% |
>= 5.5.0, < 5.5.30 | 5.5.30 |
| GHSA-cxg2-49rq-8gcr Apache Tomcat does not properly handle an invalid Transfer-Encoding header |
Medium EPSS 54.78% |
>= 6.0.0, < 6.0.28 | 6.0.28 |
| GHSA-6cr4-7c7p-p3xv Use of Hard-coded Cryptographic Key in Apache Tomcat |
Medium EPSS 6.33% |
>= 5.5.0, < 5.5.34 | 5.5.34 |
| GHSA-hffm-fqv4-w27r Improper Authentication in Apache Tomcat |
Medium EPSS 6.49% |
>= 7.0.0, < 7.0.12 | 7.0.12 |
| GHSA-hffm-fqv4-w27r Improper Authentication in Apache Tomcat |
Medium EPSS 6.49% |
>= 6.0.0, < 6.0.33 | 6.0.33 |
| GHSA-hffm-fqv4-w27r Improper Authentication in Apache Tomcat |
Medium EPSS 6.49% |
>= 5.5.0, < 5.5.34 | 5.5.34 |
| GHSA-q9xf-jwr4-v445 Authentication Bypass in Apache Tomcat |
Medium EPSS 8.24% |
>= 5.5.0, < 5.5.34 | 5.5.34 |
| GHSA-c38m-v4m2-524v Apache Tomcat Allows Remote Attackers to Spoof AJP Requests |
High EPSS 15.23% |
>= 7.0.0, < 7.0.21 | 7.0.21 |
| GHSA-c38m-v4m2-524v Apache Tomcat Allows Remote Attackers to Spoof AJP Requests |
High EPSS 15.23% |
>= 6.0.0, < 6.0.34 | 6.0.34 |
| GHSA-c38m-v4m2-524v Apache Tomcat Allows Remote Attackers to Spoof AJP Requests |
High EPSS 15.23% |
>= 5.0.0, < 5.5.34 | 5.5.34 |
| GHSA-fj6c-prgj-gr3r Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Low EPSS 1.30% |
>= 7.0.0, < 7.0.4 | 7.0.4 |
| GHSA-fj6c-prgj-gr3r Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Low EPSS 1.30% |
>= 6.0.0, < 6.0.30 | 6.0.30 |
| GHSA-fj6c-prgj-gr3r Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Low EPSS 1.30% |
>= 5.5.0, < 5.5.30 | 5.5.30 |
| GHSA-q9xf-jwr4-v445 Authentication Bypass in Apache Tomcat |
Medium EPSS 8.24% |
>= 6.0.0, < 6.0.33 | 6.0.33 |
| GHSA-q9xf-jwr4-v445 Authentication Bypass in Apache Tomcat |
Medium EPSS 8.24% |
>= 7.0.0, < 7.0.12 | 7.0.12 |
| GHSA-j448-j653-r3vj Apache Tomcat is vulnerable to HTTP request-smuggling |
Medium EPSS 16.21% |
< 6.0.39 | 6.0.39 |
| GHSA-j448-j653-r3vj Apache Tomcat is vulnerable to HTTP request-smuggling |
Medium EPSS 16.21% |
>= 7.0.0, < 7.0.47 | 7.0.47 |
| GHSA-qfxv-3ppc-7qg5 Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions |
Medium EPSS 11.00% |
>= 7.0.0, < 7.0.30 | 7.0.30 |
| GHSA-qfxv-3ppc-7qg5 Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions |
Medium EPSS 11.00% |
>= 6.0.0, < 6.0.37 | 6.0.37 |
| GHSA-j448-j653-r3vj Apache Tomcat is vulnerable to HTTP request-smuggling |
Medium EPSS 16.21% |
>= 8.0.0-RC1, < 8.0.0-RC3 | 8.0.0-RC3 |
| GHSA-6m48-jxwx-76q7 Improper Authentication in Apache Tomcat |
Medium EPSS 10.41% |
>= 7.0.0, < 7.0.33 | 7.0.33 |
| GHSA-wq2p-q66w-q8gp Apache Tomcat Denial of Service vulnerability |
Medium EPSS 9.10% |
>= 7.0.0, < 7.0.50 | 7.0.50 |
| GHSA-wq2p-q66w-q8gp Apache Tomcat Denial of Service vulnerability |
Medium EPSS 9.10% |
< 6.0.39 | 6.0.39 |
| GHSA-87w9-x2c3-hrjj Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 9.49% |
>= 7.0.0, < 7.0.50 | 7.0.50 |
| GHSA-87w9-x2c3-hrjj Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 9.49% |
>= 8.0.0-RC1, < 8.0.0-RC10 | 8.0.0-RC10 |
| GHSA-87w9-x2c3-hrjj Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 9.49% |
< 6.0.39 | 6.0.39 |
| GHSA-wq2p-q66w-q8gp Apache Tomcat Denial of Service vulnerability |
Medium EPSS 9.10% |
>= 8.0.0-RC1, < 8.0.0-RC10 | 8.0.0-RC10 |
| GHSA-6gjj-c5mj-4cvp Improper Input Validation in Apache Tomcat |
Medium EPSS 9.89% |
>= 6.0.33, < 6.0.38 | 6.0.38 |
| GHSA-6m48-jxwx-76q7 Improper Authentication in Apache Tomcat |
Medium EPSS 10.41% |
>= 6.0.21, < 6.0.37 | 6.0.37 |
| GHSA-475f-74wp-pqv5 Integer Overflow or Wraparound in Apache Tomcat |
Medium EPSS 17.58% |
>= 8.0.0, < 8.0.4 | 8.0.4 |
| GHSA-475f-74wp-pqv5 Integer Overflow or Wraparound in Apache Tomcat |
Medium EPSS 17.58% |
< 6.0.40 | 6.0.40 |
| GHSA-475f-74wp-pqv5 Integer Overflow or Wraparound in Apache Tomcat |
Medium EPSS 17.58% |
>= 7.0.0, < 7.0.53 | 7.0.53 |
| GHSA-pxcx-cxq8-4mmw Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 20.18% |
>= 6.0.0, < 6.0.44 | 6.0.44 |
| GHSA-qprx-q2r7-3rx6 Improper Input Validation in Apache Tomcat |
Medium EPSS 6.91% |
>= 7.0.0, < 7.0.54 | 7.0.54 |
| GHSA-qprx-q2r7-3rx6 Improper Input Validation in Apache Tomcat |
Medium EPSS 6.91% |
< 6.0.40 | 6.0.40 |
| GHSA-xh5x-j8jf-pcpx Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat |
Medium EPSS 8.84% |
< 6.0.40 | 6.0.40 |
| GHSA-xh5x-j8jf-pcpx Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat |
Medium EPSS 8.84% |
>= 7.0.0, < 7.0.54 | 7.0.54 |
| GHSA-xh5x-j8jf-pcpx Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat |
Medium EPSS 8.84% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-pxcx-cxq8-4mmw Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 20.18% |
>= 8.0.0, < 8.0.9 | 8.0.9 |
| GHSA-42j3-498q-m6vp Improper Input Validation in Apache Tomcat |
Medium EPSS 21.04% |
>= 6.0.0, < 6.0.42 | 6.0.42 |
| GHSA-42j3-498q-m6vp Improper Input Validation in Apache Tomcat |
Medium EPSS 21.04% |
>= 7.0.0, < 7.0.55 | 7.0.55 |
| GHSA-42j3-498q-m6vp Improper Input Validation in Apache Tomcat |
Medium EPSS 21.04% |
>= 8.0.0, < 8.0.9 | 8.0.9 |
| GHSA-qprx-q2r7-3rx6 Improper Input Validation in Apache Tomcat |
Medium EPSS 6.91% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-prc3-7f44-w48j Missing XML Validation in Apache Tomcat |
Medium EPSS 7.62% |
>= 8.0.0, < 8.0.6 | 8.0.6 |
| GHSA-pxcx-cxq8-4mmw Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 20.18% |
>= 7.0.0, < 7.0.55 | 7.0.55 |
| GHSA-prc3-7f44-w48j Missing XML Validation in Apache Tomcat |
Medium EPSS 7.62% |
>= 7.0.0, < 7.0.54 | 7.0.54 |
| GHSA-prc3-7f44-w48j Missing XML Validation in Apache Tomcat |
Medium EPSS 7.62% |
< 6.0.40 | 6.0.40 |
| GHSA-6vx3-hr43-cfrh Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 6.23% |
>= 9.0.0.M1, < 9.0.0.M2 | 9.0.0.M2 |
| GHSA-mv42-px54-87jw Improper Access Control in Apache Tomcat |
High EPSS 13.08% |
>= 6.0.0, < 6.0.46 | 6.0.46 |
| GHSA-4c43-cwvx-9crh Improper Access Control in Apache Tomcat |
Medium EPSS 13.35% |
>= 8.0.0, < 8.0.16 | 8.0.16 |
| GHSA-6vx3-hr43-cfrh Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 6.23% |
>= 8.0.0.RC1, < 8.0.31 | 8.0.31 |
| GHSA-6vx3-hr43-cfrh Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 6.23% |
>= 6.0.0, < 6.0.45 | 6.0.45 |
| GHSA-mv42-px54-87jw Improper Access Control in Apache Tomcat |
High EPSS 13.08% |
>= 7.0.0, < 7.0.70 | 7.0.70 |
| GHSA-mv42-px54-87jw Improper Access Control in Apache Tomcat |
High EPSS 13.08% |
>= 9.0.0.M1, < 9.0.0.M2 | 9.0.0.M2 |
| GHSA-mv42-px54-87jw Improper Access Control in Apache Tomcat |
High EPSS 13.08% |
>= 8.0.0.RC1, < 8.0.32 | 8.0.32 |
| GHSA-4c43-cwvx-9crh Improper Access Control in Apache Tomcat |
Medium EPSS 13.35% |
>= 6.0.0, < 6.0.44 | 6.0.44 |
| GHSA-4c43-cwvx-9crh Improper Access Control in Apache Tomcat |
Medium EPSS 13.35% |
>= 7.0.0, < 7.0.58 | 7.0.58 |
| GHSA-3gv7-3h64-78cm Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 16.84% |
>= 6.0.0, < 6.0.53 | 6.0.53 |
| GHSA-rh8q-vjgf-gf74 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 18.38% |
>= 6.0.0, < 6.0.45 | 6.0.45 |
| GHSA-3gv7-3h64-78cm Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 16.84% |
>= 9.0.0.M1, < 9.0.0.M19 | 9.0.0.M19 |
| GHSA-3gv7-3h64-78cm Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 16.84% |
>= 8.5.0, < 8.5.13 | 8.5.13 |
| GHSA-3gv7-3h64-78cm Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 16.84% |
>= 8.0.0, < 8.0.43 | 8.0.43 |
| GHSA-3gv7-3h64-78cm Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 16.84% |
>= 7.0.0, < 7.0.77 | 7.0.77 |
| GHSA-rh8q-vjgf-gf74 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 18.38% |
>= 8.0.0-RC1, < 8.0.30 | 8.0.30 |
| GHSA-rh8q-vjgf-gf74 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 18.38% |
>= 7.0.0, < 7.0.68 | 7.0.68 |
| GHSA-698c-2x4j-g9gq Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 7.19% |
>= 9.0.0.M1, < 9.0.0.M12 | 9.0.0.M12 |
| GHSA-698c-2x4j-g9gq Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 7.19% |
>= 8.5.0, < 8.5.8 | 8.5.8 |
| GHSA-6qr6-x7jm-x2q6 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 12.55% |
>= 8.0.0-RC1, < 8.0.27 | 8.0.27 |
| GHSA-6qr6-x7jm-x2q6 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 12.55% |
>= 7.0.0, < 7.0.65 | 7.0.65 |
| GHSA-6qr6-x7jm-x2q6 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 12.55% |
>= 6.0.0, < 6.0.45 | 6.0.45 |
| GHSA-rh8q-vjgf-gf74 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
Medium EPSS 18.38% |
>= 9.0.0.M1, < 9.0.0.M2 | 9.0.0.M2 |
| GHSA-fjwp-r6fm-q6qw Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request |
High EPSS 7.12% |
>= 9.0.0.M11, < 9.0.0.M16 | 9.0.0.M16 |
| GHSA-73rx-3f9r-x949 Insufficient Verification of Data Authenticity in Apache Tomcat |
Medium EPSS 8.04% |
>= 7.0.41, < 7.0.79 | 7.0.79 |
| GHSA-372q-33vh-8mpc Inconsistent documentation in Apache Tomcat |
Medium EPSS 6.08% |
>= 8.5.16, < 8.5.24 | 8.5.24 |
| GHSA-372q-33vh-8mpc Inconsistent documentation in Apache Tomcat |
Medium EPSS 6.08% |
>= 8.0.45, < 8.0.48 | 8.0.48 |
| GHSA-fjwp-r6fm-q6qw Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request |
High EPSS 7.12% |
>= 8.5.7, < 8.5.10 | 8.5.10 |
| GHSA-372q-33vh-8mpc Inconsistent documentation in Apache Tomcat |
Medium EPSS 6.08% |
>= 7.0.79, < 7.0.84 | 7.0.84 |
| GHSA-73rx-3f9r-x949 Insufficient Verification of Data Authenticity in Apache Tomcat |
Medium EPSS 8.04% |
>= 9.0.0.M1, < 9.0.0.M22 | 9.0.0.M22 |
| GHSA-73rx-3f9r-x949 Insufficient Verification of Data Authenticity in Apache Tomcat |
Medium EPSS 8.04% |
>= 8.5.0, < 8.5.16 | 8.5.16 |
| GHSA-372q-33vh-8mpc Inconsistent documentation in Apache Tomcat |
Medium EPSS 6.08% |
>= 9.0.0.M22, < 9.0.2 | 9.0.2 |
| GHSA-73rx-3f9r-x949 Insufficient Verification of Data Authenticity in Apache Tomcat |
Medium EPSS 8.04% |
>= 8.0.0.RC1, < 8.0.45 | 8.0.45 |
| GHSA-68g5-8q7f-m384 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
High EPSS 10.14% |
>= 8.5.0, < 8.5.16 | 8.5.16 |
| GHSA-68g5-8q7f-m384 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat |
High EPSS 10.14% |
>= 9.0.0.M1, < 9.0.0.M22 | 9.0.0.M22 |
| GHSA-h3ch-5pp2-vh6w Improper socket reuse in Apache Tomcat |
High EPSS 8.40% |
>= 9.0.0M1, < 9.0.20 | 9.0.20 |
| GHSA-h3ch-5pp2-vh6w Improper socket reuse in Apache Tomcat |
High EPSS 8.40% |
>= 8.5.0, < 8.5.75 | 8.5.75 |
| GHSA-jmvv-524f-hj5j Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 16.57% |
>= 8.0.0, < 8.0.44 | 8.0.44 |
| GHSA-jmvv-524f-hj5j Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 16.57% |
>= 8.5.0, < 8.5.15 | 8.5.15 |
| GHSA-jmvv-524f-hj5j Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 16.57% |
>= 9.0.0.M1, < 9.0.0.M21 | 9.0.0.M21 |
| GHSA-jmvv-524f-hj5j Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 16.57% |
>= 7.0.0, < 7.0.78 | 7.0.78 |
| GHSA-9785-w233-x6hv Improper Resource Shutdown or Release in Apache Tomcat |
High EPSS 8.28% |
>= 8.5.0, < 8.5.13 | 8.5.13 |
| GHSA-9785-w233-x6hv Improper Resource Shutdown or Release in Apache Tomcat |
High EPSS 8.28% |
>= 9.0.0.M1, < 9.0.0.M19 | 9.0.0.M19 |
| GHSA-h6c8-x5r3-pm88 Apache Tomcat Unrestricted file upload vulnerability |
Medium EPSS 13.99% |
>= 7.0, < 7.0.40 | 7.0.40 |
| GHSA-3mjp-p938-4329 Apache Tomcat vulnerable to SecurityManager bypass |
High EPSS 8.32% |
>= 7.0.0, < 7.0.71 | 7.0.71 |
| GHSA-3mjp-p938-4329 Apache Tomcat vulnerable to SecurityManager bypass |
High EPSS 8.32% |
>= 6.0.0, < 6.0.46 | 6.0.46 |
| GHSA-2rvf-329f-p99g System Property Disclosure in Apache Tomcat |
Medium EPSS 7.15% |
>= 9.0.0.M1, < 9.0.0.M10 | 9.0.0.M10 |
| GHSA-2rvf-329f-p99g System Property Disclosure in Apache Tomcat |
Medium EPSS 7.15% |
>= 7.0.0, < 7.0.72 | 7.0.72 |
| GHSA-2rvf-329f-p99g System Property Disclosure in Apache Tomcat |
Medium EPSS 7.15% |
>= 8.0.0, < 8.0.37 | 8.0.37 |
| GHSA-2rvf-329f-p99g System Property Disclosure in Apache Tomcat |
Medium EPSS 7.15% |
>= 8.1.0, < 8.5.5 | 8.5.5 |
| GHSA-3mjp-p938-4329 Apache Tomcat vulnerable to SecurityManager bypass |
High EPSS 8.32% |
>= 9.0.0.M1, < 9.0.0.M10 | 9.0.0.M10 |
| GHSA-2rvf-329f-p99g System Property Disclosure in Apache Tomcat |
Medium EPSS 7.15% |
>= 6.0.0, < 6.0.47 | 6.0.47 |
| GHSA-3mjp-p938-4329 Apache Tomcat vulnerable to SecurityManager bypass |
High EPSS 8.32% |
>= 8.5.0, < 8.5.5 | 8.5.5 |
| GHSA-3mjp-p938-4329 Apache Tomcat vulnerable to SecurityManager bypass |
High EPSS 8.32% |
>= 8.0.0.RC1, < 8.0.37 | 8.0.37 |
| GHSA-q6x7-f33r-3wxx Incorrect Authorization in Apache Tomcat |
High EPSS 8.07% |
>= 8.5.0, < 8.5.5 | 8.5.5 |
| GHSA-wxcp-f2c8-x6xv Observable Discrepancy in Apache Tomcat |
Medium EPSS 7.99% |
>= 6.0.0, < 6.0.46 | 6.0.46 |
| GHSA-wxcp-f2c8-x6xv Observable Discrepancy in Apache Tomcat |
Medium EPSS 7.99% |
>= 7.0.0, < 7.0.72 | 7.0.72 |
| GHSA-wxcp-f2c8-x6xv Observable Discrepancy in Apache Tomcat |
Medium EPSS 7.99% |
>= 8.0.0.RC1, < 8.0.37 | 8.0.37 |
| GHSA-wxcp-f2c8-x6xv Observable Discrepancy in Apache Tomcat |
Medium EPSS 7.99% |
>= 8.5.0, < 8.5.5 | 8.5.5 |
| GHSA-q6x7-f33r-3wxx Incorrect Authorization in Apache Tomcat |
High EPSS 8.07% |
>= 9.0.0.M1, < 9.0.0.M10 | 9.0.0.M10 |
| GHSA-q6x7-f33r-3wxx Incorrect Authorization in Apache Tomcat |
High EPSS 8.07% |
>= 8.0.0, < 8.0.37 | 8.0.37 |
| GHSA-q6x7-f33r-3wxx Incorrect Authorization in Apache Tomcat |
High EPSS 8.07% |
>= 7.0.0, < 7.0.72 | 7.0.72 |
| GHSA-wxcp-f2c8-x6xv Observable Discrepancy in Apache Tomcat |
Medium EPSS 7.99% |
>= 9.0.0M1, < 9.0.0.M10 | 9.0.0.M10 |
| GHSA-r84p-88g2-2vx2 Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption |
High EPSS 73.47% |
>= 10.0.0-M1, < 10.0.21 | 10.0.21 |
| GHSA-r84p-88g2-2vx2 Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption |
High EPSS 73.47% |
>= 10.1.0-M1, < 10.1.0-M15 | 10.1.0-M15 |
| GHSA-r84p-88g2-2vx2 Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption |
High EPSS 73.47% |
>= 8.5.38, < 8.5.79 | 8.5.79 |
| GHSA-r84p-88g2-2vx2 Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption |
High EPSS 73.47% |
>= 9.0.13, < 9.0.63 | 9.0.63 |
| GHSA-8h2q-qm9x-55jc Denial of Service in Apache Tomcat |
Medium EPSS 10.48% |
>= 5.5.0, < 5.5.35 | 5.5.35 |
| GHSA-8h2q-qm9x-55jc Denial of Service in Apache Tomcat |
Medium EPSS 10.48% |
>= 6.0.0, < 6.0.34 | 6.0.34 |
| GHSA-8h2q-qm9x-55jc Denial of Service in Apache Tomcat |
Medium EPSS 10.48% |
>= 7.0.0, < 7.0.23 | 7.0.23 |
| GHSA-3p86-xgrq-m6p6 Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
Medium EPSS 10.01% |
>= 7.0.0, < 7.0.6 | 7.0.6 |
| GHSA-3p86-xgrq-m6p6 Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
Medium EPSS 10.01% |
>= 6.0.0, < 6.0.30 | 6.0.30 |
| GHSA-3p86-xgrq-m6p6 Improper Neutralization of Input During Web Page Generation in Apache Tomcat |
Medium EPSS 10.01% |
>= 5.5.0, < 5.5.32 | 5.5.32 |
| GHSA-w6q7-ww2x-7gm3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 52.51% |
>= 6.0.0, < 6.0.28 | 6.0.28 |
| GHSA-w6q7-ww2x-7gm3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 52.51% |
>= 5.5.0, < 5.5.30 | 5.5.30 |
| GHSA-f7w7-6pjc-wwm6 Apache Tomcat affected by vulnerability in TLS and SSL protocol |
Critical EPSS 87.26% |
>= 7.0.0, < 7.0.10 | 7.0.10 |
| GHSA-f7w7-6pjc-wwm6 Apache Tomcat affected by vulnerability in TLS and SSL protocol |
Critical EPSS 87.26% |
>= 5.0.0, < 5.5.33 | 5.5.33 |
| GHSA-f7w7-6pjc-wwm6 Apache Tomcat affected by vulnerability in TLS and SSL protocol |
Critical EPSS 87.26% |
>= 6.0.0, < 6.0.32 | 6.0.32 |
| GHSA-8wch-9gcg-v2pr Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat |
Medium EPSS 10.74% |
>= 6.0.0, < 6.0.24 | 6.0.24 |
| GHSA-8wch-9gcg-v2pr Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat |
Medium EPSS 10.74% |
>= 5.5.0, < 5.5.29 | 5.5.29 |
| GHSA-hjfh-7c4v-7q8h Improper Authentication in Apache Tomcat |
Medium EPSS 8.12% |
>= 5.5.0, < 5.5.29 | 5.5.29 |
| GHSA-hjfh-7c4v-7q8h Improper Authentication in Apache Tomcat |
Medium EPSS 8.12% |
>= 6.0.0, < 6.0.24 | 6.0.24 |
| GHSA-ggx9-4728-588r Apache Tomcat Directory Traversal vulnerability |
Medium EPSS 9.64% |
>= 6.0.0, < 6.0.24 | 6.0.24 |
| GHSA-ggx9-4728-588r Apache Tomcat Directory Traversal vulnerability |
Medium EPSS 9.64% |
>= 5.5.0, < 5.5.29 | 5.5.29 |
| GHSA-hhjg-g8xq-hhr3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 0.81% |
>= 6.0.0, < 6.0.20 | 6.0.20 |
| GHSA-hhjg-g8xq-hhr3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 0.81% |
>= 5.5.0, <= 5.5.27 | No fix yet |
| GHSA-hhjg-g8xq-hhr3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 0.81% |
>= 4.1.0, <= 4.1.39 | No fix yet |
| GHSA-j788-fx57-99wp Cross-site scripting in Apache Tomcat |
Medium EPSS 9.72% |
>= 6.0.0, < 6.0.20 | 6.0.20 |
| GHSA-j788-fx57-99wp Cross-site scripting in Apache Tomcat |
Medium EPSS 9.72% |
>= 5.5.0, <= 5.5.27 | No fix yet |
| GHSA-j788-fx57-99wp Cross-site scripting in Apache Tomcat |
Medium EPSS 9.72% |
>= 4.1.0, <= 4.1.39 | No fix yet |
| GHSA-w227-xcfx-3pj8 Exposure of Sensitive Information in Apache Tomcat |
Medium EPSS 94.44% |
>= 4.1.0, < 4.1.40 | 4.1.40 |
| GHSA-w227-xcfx-3pj8 Exposure of Sensitive Information in Apache Tomcat |
Medium EPSS 94.44% |
>= 5.0.0, < 5.5.28 | 5.5.28 |
| GHSA-w227-xcfx-3pj8 Exposure of Sensitive Information in Apache Tomcat |
Medium EPSS 94.44% |
>= 6.0.0, < 6.0.19 | 6.0.19 |
| GHSA-5cw4-ggx9-36vg Apache Tomcat Denial of Service via Malformed Request Headers |
Medium EPSS 10.05% |
>= 5.5.0, <= 5.5.27 | No fix yet |
| GHSA-5cw4-ggx9-36vg Apache Tomcat Denial of Service via Malformed Request Headers |
Medium EPSS 10.05% |
>= 4.1.0, <= 4.1.39 | No fix yet |
| GHSA-5cw4-ggx9-36vg Apache Tomcat Denial of Service via Malformed Request Headers |
Medium EPSS 10.05% |
>= 6.0.0, <= 6.0.18 | No fix yet |
| GHSA-7g59-hm8v-cwmc Apache Tomcat information disclosure vulnerability |
Low EPSS 4.17% |
>= 5.5.10, < 5.5.21 | 5.5.21 |
| GHSA-7g59-hm8v-cwmc Apache Tomcat information disclosure vulnerability |
Low EPSS 4.17% |
>= 4.1.32, < 4.1.35 | 4.1.35 |
| GHSA-m7xj-ccqc-p4g2 Apache Tomcat Directory Traversal vulnerability |
Medium EPSS 99.71% |
>= 6.0.0, < 6.0.18 | 6.0.18 |
| GHSA-m7xj-ccqc-p4g2 Apache Tomcat Directory Traversal vulnerability |
Medium EPSS 99.71% |
>= 4.1.0, < 4.1.39 | 4.1.39 |
| GHSA-m7xj-ccqc-p4g2 Apache Tomcat Directory Traversal vulnerability |
Medium EPSS 99.71% |
>= 5.5.0, < 5.5.27 | 5.5.27 |
| GHSA-m8h8-6rvg-f4mg Apache Tomcat Path Traversal Vulnerability |
Medium EPSS 52.72% |
>= 5.5.0, < 5.5.27 | 5.5.27 |
| GHSA-m8h8-6rvg-f4mg Apache Tomcat Path Traversal Vulnerability |
Medium EPSS 52.72% |
>= 4.1.0, < 4.1.38 | 4.1.38 |
| GHSA-m8h8-6rvg-f4mg Apache Tomcat Path Traversal Vulnerability |
Medium EPSS 52.72% |
>= 6.0.0, < 6.0.18 | 6.0.18 |
| GHSA-f98p-9pp6-7q6c Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 9.78% |
>= 5.5.9, < 5.5.27 | 5.5.27 |
| GHSA-f98p-9pp6-7q6c Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 9.78% |
>= 6.0.0, < 6.0.18 | 6.0.18 |
| GHSA-q74x-qqhr-f8rx Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 75.87% |
>= 6.0.0, < 6.0.17 | 6.0.17 |
| GHSA-q74x-qqhr-f8rx Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 75.87% |
>= 4.1.0, < 4.1.38 | 4.1.38 |
| GHSA-q74x-qqhr-f8rx Apache Tomcat Cross-site scripting (XSS) vulnerability |
Medium EPSS 75.87% |
>= 5.5.0, < 5.5.27 | 5.5.27 |
| GHSA-5x5f-9r6q-q7mh Apache Tomcat Sensitive Information Disclosure |
Medium EPSS 5.02% |
>= 6.0.0, < 6.0.16 | 6.0.16 |
| GHSA-qrj4-rmqg-4hcp Apache Tomcat Does Not Properly Handle Empty Requests |
Medium EPSS 5.37% |
>= 6.0.0, <= 6.0.15 | No fix yet |
| GHSA-qrj4-rmqg-4hcp Apache Tomcat Does Not Properly Handle Empty Requests |
Medium EPSS 5.37% |
>= 5.5.11, <= 5.5.25 | No fix yet |
| GHSA-v5p2-vg3c-pmrr Apache Tomcat Path Traversal Vulnerability |
Low EPSS 39.68% |
No fix yet | |
| GHSA-v5p2-vg3c-pmrr Apache Tomcat Path Traversal Vulnerability |
Low EPSS 39.68% |
>= 6.0.0, <= 6.0.14 | No fix yet |
| GHSA-v5p2-vg3c-pmrr Apache Tomcat Path Traversal Vulnerability |
Low EPSS 39.68% |
>= 5.5.0, <= 5.5.25 | No fix yet |
| GHSA-v5p2-vg3c-pmrr Apache Tomcat Path Traversal Vulnerability |
Low EPSS 39.68% |
No fix yet | |
| GHSA-v5p2-vg3c-pmrr Apache Tomcat Path Traversal Vulnerability |
Low EPSS 39.68% |
>= 4.0.0, <= 4.0.6 | No fix yet |
| GHSA-cww4-vj5r-rx57 Exposure of Sensitive Information in Apache Tomcat |
Medium EPSS 62.58% |
>= 6.0.0, < 6.0.15 | 6.0.15 |
| GHSA-cww4-vj5r-rx57 Exposure of Sensitive Information in Apache Tomcat |
Medium EPSS 62.58% |
>= 5.5.0, < 5.5.26 | 5.5.26 |
| GHSA-cww4-vj5r-rx57 Exposure of Sensitive Information in Apache Tomcat |
Medium EPSS 62.58% |
>= 4.1.0, < 4.1.37 | 4.1.37 |
| GHSA-g77g-vjjm-x83j Apache Tomcat Example Application CSRF and XSS Vulnerabilities |
Medium EPSS 2.14% |
<= 4.1.31 | No fix yet |
| GHSA-36hp-4x3g-phrg Apache Tomcat's CookieExample Vulnerable to XSS |
Medium EPSS 3.17% |
>= 3.3.0, <= 3.3.2 | No fix yet |
| GHSA-6j8f-66vh-39mj Apache Tomcat Mishandles Character Sequence in Cookies |
Medium EPSS 16.94% |
>= 4.1.0, <= 4.1.36 | No fix yet |
| GHSA-qff8-g48j-pwpw Apache Tomcat treats single quotes as delimiters in cookies |
Medium EPSS 37.50% |
>= 3.3.0, <= 3.3.2 | No fix yet |
| GHSA-qff8-g48j-pwpw Apache Tomcat treats single quotes as delimiters in cookies |
Medium EPSS 37.50% |
>= 4.1.0, <= 4.1.36 | No fix yet |
| GHSA-qff8-g48j-pwpw Apache Tomcat treats single quotes as delimiters in cookies |
Medium EPSS 37.50% |
>= 5.0.0, <= 5.0.30 | No fix yet |
| GHSA-wjwr-3jch-479j Apache Tomcat SendMailServlet XSS |
Medium EPSS 9.48% |
>= 4.0.0, <= 4.0.6 | No fix yet |
| GHSA-wjwr-3jch-479j Apache Tomcat SendMailServlet XSS |
Medium EPSS 9.48% |
>= 4.1.0, <= 4.1.36 | No fix yet |
| GHSA-qff8-g48j-pwpw Apache Tomcat treats single quotes as delimiters in cookies |
Medium EPSS 37.50% |
>= 5.5.0, <= 5.5.24 | No fix yet |
| GHSA-qff8-g48j-pwpw Apache Tomcat treats single quotes as delimiters in cookies |
Medium EPSS 37.50% |
>= 6.0.0, <= 6.0.13 | No fix yet |
| GHSA-6j8f-66vh-39mj Apache Tomcat Mishandles Character Sequence in Cookies |
Medium EPSS 16.94% |
>= 3.3.0, <= 3.3.2 | No fix yet |
| GHSA-6j8f-66vh-39mj Apache Tomcat Mishandles Character Sequence in Cookies |
Medium EPSS 16.94% |
>= 5.0.0, <= 5.0.30 | No fix yet |
| GHSA-6j8f-66vh-39mj Apache Tomcat Mishandles Character Sequence in Cookies |
Medium EPSS 16.94% |
>= 5.5.0, <= 5.5.24 | No fix yet |
| GHSA-6j8f-66vh-39mj Apache Tomcat Mishandles Character Sequence in Cookies |
Medium EPSS 16.94% |
>= 6.0.0, <= 6.0.13 | No fix yet |
| GHSA-5c5p-jxvx-x7j2 Apache Tomcat vulnerable to Cross-site Scripting |
Low EPSS 3.29% |
>= 5.0.0, <= 5.0.30 | No fix yet |
| GHSA-5c5p-jxvx-x7j2 Apache Tomcat vulnerable to Cross-site Scripting |
Low EPSS 3.29% |
>= 4.0.0, <= 4.0.6 | No fix yet |
| GHSA-hc39-rjwp-qffq Apache Tomcat XSS Vulnerabilities in Examples Web Application |
Medium EPSS 77.38% |
>= 6.0.0, <= 6.0.13 | No fix yet |
| GHSA-hc39-rjwp-qffq Apache Tomcat XSS Vulnerabilities in Examples Web Application |
Medium EPSS 77.38% |
>= 5.5.0, <= 5.5.24 | No fix yet |
| GHSA-5c5p-jxvx-x7j2 Apache Tomcat vulnerable to Cross-site Scripting |
Low EPSS 3.29% |
>= 5.5.0, < 5.5.25 | 5.5.25 |
| GHSA-hc39-rjwp-qffq Apache Tomcat XSS Vulnerabilities in Examples Web Application |
Medium EPSS 77.38% |
>= 5.0.0, <= 5.0.30 | No fix yet |
| GHSA-hc39-rjwp-qffq Apache Tomcat XSS Vulnerabilities in Examples Web Application |
Medium EPSS 77.38% |
>= 4.0.0, <= 4.0.6 | No fix yet |
| GHSA-5c5p-jxvx-x7j2 Apache Tomcat vulnerable to Cross-site Scripting |
Low EPSS 3.29% |
>= 4.1.0, < 4.1.37 | 4.1.37 |
| GHSA-5c5p-jxvx-x7j2 Apache Tomcat vulnerable to Cross-site Scripting |
Low EPSS 3.29% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-xmc9-6p56-3c4v Apache Tomcat XSS In Accept-Language Headers |
Low EPSS 19.89% |
>= 4.1.0, <= 4.1.34 | No fix yet |
| GHSA-xmc9-6p56-3c4v Apache Tomcat XSS In Accept-Language Headers |
Low EPSS 19.89% |
>= 4.0.0, <= 4.0.6 | No fix yet |
| GHSA-4prh-gqw8-rgh5 Apache Tomcat Directory Traversal |
Medium EPSS 91.16% |
>= 5.0, < 5.5.22 | 5.5.22 |
| GHSA-4prh-gqw8-rgh5 Apache Tomcat Directory Traversal |
Medium EPSS 91.16% |
>= 6.0, < 6.0.10 | 6.0.10 |
| GHSA-pm78-wxxf-fw98 Cross-site scripting in Apache Tomcat |
Medium EPSS 72.17% |
>= 4.0.0, < 4.0.7 | 4.0.7 |
| GHSA-jpqr-vh55-xqxf Apache Tomcat Buffer Over-Read |
High EPSS 8.32% |
<= 5.5.15 | No fix yet |
| GHSA-pm78-wxxf-fw98 Cross-site scripting in Apache Tomcat |
Medium EPSS 72.17% |
>= 5.5.0, < 5.5.16 | 5.5.16 |
| GHSA-pm78-wxxf-fw98 Cross-site scripting in Apache Tomcat |
Medium EPSS 72.17% |
>= 5.0.0, < 5.0.31 | 5.0.31 |
| GHSA-p57v-p3fx-qgwm Apache Tomcat XSS Vulnerability |
Medium EPSS 5.48% |
>= 5.0.0, <= 5.0.30 | No fix yet |
| GHSA-p57v-p3fx-qgwm Apache Tomcat XSS Vulnerability |
Medium EPSS 5.48% |
>= 5.5.0, < 5.5.18 | 5.5.18 |
| GHSA-pm78-wxxf-fw98 Cross-site scripting in Apache Tomcat |
Medium EPSS 72.17% |
>= 4.1.0, < 4.1.32 | 4.1.32 |
| GHSA-wfj7-mhr5-pcwq Apache Tomcat Reveals Directories |
Medium EPSS 48.05% |
>= 5.0.0, < 5.5.17 | 5.5.17 |
| GHSA-qrcx-p4rr-g48h Apache Tomcat allows remote attackers to read JSP source files |
High EPSS 3.47% |
>= 4.1.15, <= 4.1.40 | No fix yet |
| GHSA-x89r-2wjq-mj7x Apache Tomcat Discloses MS-DOS Pathname |
Medium EPSS 25.67% |
<= 4.0.3 | No fix yet |
| GHSA-8f4w-jwqv-5cxc Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests |
High EPSS 5.95% |
>= 5.5.0, < 5.5.12 | 5.5.12 |
| GHSA-qhqv-q4xg-f6g7 Apache Tomcat AJP Connector Information Leak |
Low EPSS 6.52% |
>= 4.1.0, <= 4.1.36 | No fix yet |
| GHSA-qhqv-q4xg-f6g7 Apache Tomcat AJP Connector Information Leak |
Low EPSS 6.52% |
>= 4.0.1, <= 4.0.6 | No fix yet |
| GHSA-f2gq-p6qv-ccw4 Tomcat Vulnerable to Web Cache Poisoning |
Medium EPSS 26.11% |
>= 4.0.0, <= 4.1.24 | No fix yet |
| GHSA-f2gq-p6qv-ccw4 Tomcat Vulnerable to Web Cache Poisoning |
Medium EPSS 26.11% |
>= 5.0.0, <= 5.0.19 | No fix yet |
| GHSA-pqr5-9v2j-44xg Apache Tomcat DoS via Malicious Get Request |
High EPSS 9.68% |
>= 4.0.0, <= 4.1.12 | No fix yet |
| GHSA-m8w6-7rh6-4xj6 Apache Tomcat Leaks Information via Error Message |
Medium EPSS 7.11% |
< 4.1.3 | 4.1.3 |
| GHSA-r6cf-cr44-m8rr Apache Tomcat Leaks Pathname Information via Error Message |
Medium EPSS 7.31% |
>= 4.0.0, <= 4.0.1 | No fix yet |
| GHSA-8g4f-fh7f-4fwh Apache Tomcat Default Installation Reveals Sensitive Information |
Low EPSS 30.67% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-8g4f-fh7f-4fwh Apache Tomcat Default Installation Reveals Sensitive Information |
Low EPSS 30.67% |
>= 3.0, < 3.3a | 3.3a |
| GHSA-86fp-jgwm-wgj5 Apache Tomcat XSS Vulnerability |
Medium EPSS 27.08% |
>= 4.1.0, < 4.1.29 | 4.1.29 |
| GHSA-8v5p-2cpv-c2x6 Apache Tomcat Source Code Disclosure |
High EPSS 5.85% |
< 4.0.6 | 4.0.6 |
| GHSA-jxcv-v856-j5vg Apache Tomcat Source Code Disclosure |
Medium EPSS 18.65% |
>= 4.1.0, < 4.1.12 | 4.1.12 |
| GHSA-jxcv-v856-j5vg Apache Tomcat Source Code Disclosure |
Medium EPSS 18.65% |
>= 4.0.0, < 4.0.5 | 4.0.5 |
| GHSA-xmf4-j3j7-xj7q Apache Tomcat DoS Via Requests Including Null Characters |
Medium EPSS 7.85% |
< 4.1.3-beta | 4.1.3-beta |
| GHSA-p543-jg43-9pm5 Apache Tomcat may be started without proper security settings |
High EPSS 3.80% |
< 4.0b7 | 4.0b7 |
| GHSA-2w2w-cv3h-rr38 Apache Tomcat Reveals Path through Long URL |
Medium EPSS 7.80% |
< 4.0.2 | 4.0.2 |
| GHSA-58hj-575g-5j25 Apache Tomcat allows webmasters to insert xss into error messages |
Medium EPSS 12.18% |
<= 3.2.1 | No fix yet |
| GHSA-4gr9-99j3-vqxv Apache Tomcat Directory Traversal |
Medium EPSS 3.45% |
<= 3.1 | No fix yet |
| GHSA-qg4g-6jcq-rw93 Jakarta Apache Tomcat Reveals Physical Paths |
Medium EPSS 25.66% |
<= 3.1 | No fix yet |
| GHSA-7wj2-48c4-2684 Apache Tomcat Denial of Service vulnerability in the Catalina package |
Medium EPSS 34.82% |
>= 4.0, < 4.1.0 | 4.1.0 |
| GHSA-cvx5-7vc7-rg77 Tomcat uses trusted privileges when processing web.xml file |
Medium EPSS 4.51% |
< 3.3.1a | 3.3.1a |
| GHSA-5hgm-qm5m-5vmw Jakarta Tomcat cross-site scripting (XSS) vulnerability |
Medium EPSS 9.13% |
>= 3.0, < 3.3.2 | 3.3.2 |
| GHSA-w97x-xfxf-f9xj Jakarta Tomcat Denial of Service vulnerability |
Medium EPSS 2.49% |
< 3.3.1a | 3.3.1a |
| GHSA-qfw2-wvrw-mvw4 Jakarta Tomcat Directory Listing vulnerability |
Medium EPSS 46.03% |
< 3.3.1a | 3.3.1a |
| GHSA-gc58-v8h3-x2gr Incorrect Default Permissions in Apache Tomcat Withdrawn |
High EPSS 0.86% |
>= 9.0.0, < 9.0.35 | 9.0.35 |
| GHSA-gc58-v8h3-x2gr Incorrect Default Permissions in Apache Tomcat Withdrawn |
High EPSS 0.86% |
< 8.0.53 | 8.0.53 |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 26.70% |
>= 10.0.0-M1, < 10.0.0-M5 | 10.0.0-M5 |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 26.70% |
>= 9.0.0.M1, < 9.0.35 | 9.0.35 |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat |
High EPSS 26.70% |
>= 8.5.0, < 8.5.55 | 8.5.55 |
| GHSA-m7jv-hq7h-mq7c Infinite Loop in Apache Tomcat |
High EPSS 86.61% |
>= 7.0.27, < 7.0.105 | 7.0.105 |
| GHSA-m7jv-hq7h-mq7c Infinite Loop in Apache Tomcat |
High EPSS 86.61% |
>= 10.0.0-M1, < 10.0.0-M7 | 10.0.0-M7 |
| GHSA-m7jv-hq7h-mq7c Infinite Loop in Apache Tomcat |
High EPSS 86.61% |
>= 9.0.0.M1, < 9.0.37 | 9.0.37 |
| GHSA-m7jv-hq7h-mq7c Infinite Loop in Apache Tomcat |
High EPSS 86.61% |
>= 8.5.0, < 8.5.57 | 8.5.57 |
| GHSA-vf77-8h7g-gghp Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 64.12% |
>= 10.0.0-M1, < 10.0.0-M6 | 10.0.0-M6 |
| GHSA-vf77-8h7g-gghp Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 64.12% |
>= 8.5.1, < 8.5.56 | 8.5.56 |
| GHSA-vf77-8h7g-gghp Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 64.12% |
>= 9.0.0.M5, < 9.0.36 | 9.0.36 |
| GHSA-9f3j-pm6f-9fm5 Race condition in Apache Tomcat |
High EPSS 0.69% |
>= 10.0.0, < 10.0.16 | 10.0.16 |
| GHSA-9f3j-pm6f-9fm5 Race condition in Apache Tomcat |
High EPSS 0.69% |
< 8.5.75 | 8.5.75 |
| GHSA-9f3j-pm6f-9fm5 Race condition in Apache Tomcat |
High EPSS 0.69% |
>= 9.0.0, < 9.0.58 | 9.0.58 |
| GHSA-wph7-x527-w3h5 Missing Release of Resource after Effective Lifetime in Apache Tomcat |
High EPSS 11.80% |
>= 10.1.0-M1, < 10.1.0-M6 | 10.1.0-M6 |
| GHSA-wph7-x527-w3h5 Missing Release of Resource after Effective Lifetime in Apache Tomcat |
High EPSS 11.80% |
>= 8.5.60, < 8.5.72 | 8.5.72 |
| GHSA-wph7-x527-w3h5 Missing Release of Resource after Effective Lifetime in Apache Tomcat |
High EPSS 11.80% |
>= 9.0.40, < 9.0.54 | 9.0.54 |
| GHSA-wph7-x527-w3h5 Missing Release of Resource after Effective Lifetime in Apache Tomcat |
High EPSS 11.80% |
>= 10.0.0-M1, < 10.0.12 | 10.0.12 |
| GHSA-59g9-7gfx-c72p Infinite loop in Tomcat due to parsing error |
High EPSS 7.18% |
>= 8.5.0, < 8.5.64 | 8.5.64 |
| GHSA-59g9-7gfx-c72p Infinite loop in Tomcat due to parsing error |
High EPSS 7.18% |
>= 9.0.0, < 9.0.44 | 9.0.44 |
| GHSA-59g9-7gfx-c72p Infinite loop in Tomcat due to parsing error |
High EPSS 7.18% |
>= 10.0.0, < 10.0.4 | 10.0.4 |
| GHSA-36qh-35cm-5w2w Authentication Bypass by Alternate Name in Apache Tomcat |
Medium EPSS 9.89% |
>= 9.0.0M1, < 9.0.45 | 9.0.45 |
| GHSA-36qh-35cm-5w2w Authentication Bypass by Alternate Name in Apache Tomcat |
Medium EPSS 9.89% |
>= 8.5.0, < 8.5.65 | 8.5.65 |
| GHSA-36qh-35cm-5w2w Authentication Bypass by Alternate Name in Apache Tomcat |
Medium EPSS 9.89% |
>= 10.0.0-M1, < 10.0.5 | 10.0.5 |
| GHSA-4vww-mc66-62m6 HTTP Request Smuggling in Apache Tomcat |
Medium EPSS 74.67% |
>= 9.0.0-M1, < 9.0.48 | 9.0.48 |
| GHSA-4vww-mc66-62m6 HTTP Request Smuggling in Apache Tomcat |
Medium EPSS 74.67% |
>= 8.5.0, < 8.5.68 | 8.5.68 |
| GHSA-4vww-mc66-62m6 HTTP Request Smuggling in Apache Tomcat |
Medium EPSS 74.67% |
>= 10.0.0-M1, < 10.0.7 | 10.0.7 |
| GHSA-44qp-qhfv-c7f6 Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 6.89% |
>= 10.0.3, < 10.0.5 | 10.0.5 |
| GHSA-44qp-qhfv-c7f6 Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 6.89% |
>= 9.0.0, < 9.0.45 | 9.0.45 |
| GHSA-44qp-qhfv-c7f6 Improper Handling of Exceptional Conditions in Apache Tomcat |
High EPSS 6.89% |
< 8.5.65 | 8.5.65 |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 8.87% |
>= 8.5.48, < 8.5.51 | 8.5.51 |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 8.87% |
>= 7.0.98, < 7.0.100 | 7.0.100 |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 8.87% |
>= 9.0.28, < 9.0.31 | 9.0.31 |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 9.39% |
< 7.0.100 | 7.0.100 |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 9.39% |
>= 8.0.0, < 8.5.51 | 8.5.51 |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat |
Medium EPSS 9.39% |
>= 9.0.0, < 9.0.31 | 9.0.31 |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat |
Medium EPSS 59.19% |
>= 9.0.0, < 9.0.17 | 9.0.17 |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat |
Medium EPSS 59.19% |
>= 8.5.0, < 8.5.40 | 8.5.40 |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat |
Medium EPSS 59.19% |
>= 7.0.0, < 7.0.94 | 7.0.94 |
| GHSA-xx68-jfcg-xmmf Commons FileUpload Denial of service vulnerability |
High EPSS 83.33% |
>= 8.0.0-RC1, < 8.0.3 | 8.0.3 |
| GHSA-xx68-jfcg-xmmf Commons FileUpload Denial of service vulnerability |
High EPSS 83.33% |
>= 7.0.0, < 7.0.52 | 7.0.52 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor