CVSS: 5.9EPSS: 4%CPEs: 123EXPL: 0CVE-2017-7674 – tomcat: Vary header not added by CORS filter leading to cache poisoning
https://notcve.org/view.php?id=CVE-2017-7674
11 Aug 2017 — The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. CORS Filter en Apache Tomcat 9.0.0.M1 a 9.0.0.M21, 8.5.0 a 8.5.15, 8.0.0.RC1 a 8.0.44 y 7.0.41 a 7.0.78 no añadió un encabezado HTTP Vary indicando que la respuesta varía dependiendo de Origin. Esto permitía, en algunas circunstanci... • http://www.debian.org/security/2017/dsa-3974 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.5EPSS: 3%CPEs: 37EXPL: 0CVE-2017-7675
https://notcve.org/view.php?id=CVE-2017-7675
11 Aug 2017 — The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL. La implementación HTTP/2 en Apache Tomcat en sus versiones 9.0.0.M1 a 9.0.0.M21 y 8.5.0 a 8.5.15 eludía una serie de verificaciones de seguridad que prevenían ataques de salto de directorio. Por lo tanto, era posible eludir restricciones de seguridad emplean... • http://www.debian.org/security/2017/dsa-3974 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2016-6817
https://notcve.org/view.php?id=CVE-2016-6817
10 Aug 2017 — The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible. El parser de cabecera HTTP/2 en Apache Tomcat en sus versiones 9.0.0.M1 a 9.0.0.M11 y 8.5.0 a 8.5.6 entraba en un bucle infinito si la cabecera recibida era mayor que el búfer disponible. Esto hizo que fuese posible realizar un ataque de denegación de servicio. • http://www.securityfocus.com/bid/94462 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 6%CPEs: 161EXPL: 0CVE-2017-5664 – tomcat: Security constrained bypass in error page mechanism
https://notcve.org/view.php?id=CVE-2017-5664
06 Jun 2017 — The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0... • http://www.debian.org/security/2017/dsa-3891 • CWE-266: Incorrect Privilege Assignment CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 2%CPEs: 205EXPL: 0CVE-2017-5647 – tomcat: Incorrect handling of pipelined requests when send file was used
https://notcve.org/view.php?id=CVE-2017-5647
17 Apr 2017 — A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B ... • http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 23%CPEs: 31EXPL: 0CVE-2017-5650 – Gentoo Linux Security Advisory 201705-09
https://notcve.org/view.php?id=CVE-2017-5650
17 Apr 2017 — In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads. En Apache Tomcat 9.0.0.M1 a 9.0.0.M18 y 8.5.0 a 8.5.12, el tratamiento... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html • CWE-404: Improper Resource Shutdown or Release •
CVSS: 9.1EPSS: 21%CPEs: 148EXPL: 0CVE-2017-5648 – tomcat: Calls to application listeners did not use the appropriate facade object
https://notcve.org/view.php?id=CVE-2017-5648
10 Apr 2017 — While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. Cuando se investigaba ... • http://www.debian.org/security/2017/dsa-3842 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.8EPSS: 7%CPEs: 31EXPL: 0CVE-2017-5651 – Gentoo Linux Security Advisory 201705-09
https://notcve.org/view.php?id=CVE-2017-5651
10 Apr 2017 — In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up. En Apache Tomcat 9.0.0.M1 a 9.0.0.M18 y 8.5.0 a 8.5.12, la refactorización de los conectores H... • http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html •
CVSS: 5.3EPSS: 0%CPEs: 31EXPL: 0CVE-2016-6794 – tomcat: system property disclosure
https://notcve.org/view.php?id=CVE-2016-6794
24 Jan 2017 — When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. Cuando se configura un SecurityManager, la capacidad de una aplicación w... • http://rhn.redhat.com/errata/RHSA-2017-0457.html •
CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 0CVE-2016-6796 – tomcat: security manager bypass via JSP Servlet config parameters
https://notcve.org/view.php?id=CVE-2016-6796
24 Jan 2017 — A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. Una aplicación web maliciosa en Apache Tomcat 9.0.0.M1 a 9.0.0.M9, 8.5.0 a 8.5.4, 8.0.0.RC1 a 8.0.36, 7.0.0 a 7.0.70, y 6.0.0 a 6.0.45 era capaz de eludir un SecurityManager configurado mediante la manipulación de los parámetros de configuración ... • http://rhn.redhat.com/errata/RHSA-2017-0457.html •