CVSS: 5.8EPSS: 8%CPEs: 240EXPL: 0CVE-2014-7810 – Tomcat/JbossWeb: security manager bypass via EL expressions
https://notcve.org/view.php?id=CVE-2014-7810
14 May 2015 — The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation. La implementación Expression Language (EL) en Apache Tomcat 6.x anterior a 6.0.44, 7.x anterior a 7.0.58, y 8.x anterior a 8... • http://marc.info/?l=bugtraq&m=145974991225029&w=2 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 84%CPEs: 110EXPL: 0CVE-2014-0227 – Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter
https://notcve.org/view.php?id=CVE-2014-0227
09 Feb 2015 — java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. java/org/apache/coyote/http11/filters/ChunkedInputFilter.java en Apache Tomcat 6.x anterior a 6.0.42, 7.... • http://advisories.mageia.org/MGASA-2015-0081.html • CWE-19: Data Processing Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 7%CPEs: 114EXPL: 0CVE-2014-0230 – tomcat: non-persistent DoS attack by feeding data by aborting an upload
https://notcve.org/view.php?id=CVE-2014-0230
17 Sep 2014 — Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts. Apache Tomcat 6.x en versiones anteriores a 6.0.44, 7.x en versiones anteriores a 7.0.55 y 8.x en versiones anteriores a 8.0.9 no maneja adecuadamente los casos en los que se produce una respuesta HTTP... • http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.3EPSS: 6%CPEs: 38EXPL: 0CVE-2013-4444 – Apache Tomcat 7.0.39 Remote Code Execution
https://notcve.org/view.php?id=CVE-2013-4444
10 Sep 2014 — Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. Vulnerabilidad de la subida de ficheros sin restricciones Apache Tomcat 7.x anterior a 7.0.40, en ciertas situaciones que implican código anticuado java.io.File y configuración JMX personalizada, permite a atacantes remotos ejecutar código arbitrario median... • http://archives.neohapsis.com/archives/bugtraq/2014-09/0075.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 1%CPEs: 109EXPL: 0CVE-2014-0119 – Tomcat/JBossWeb: XML parser hijack by malicious web application
https://notcve.org/view.php?id=CVE-2014-0119
30 May 2014 — Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web applica... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-264: Permissions, Privileges, and Access Controls CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 4.3EPSS: 1%CPEs: 107EXPL: 0CVE-2014-0096 – Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
https://notcve.org/view.php?id=CVE-2014-0096
30 May 2014 — java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. java/org/apache/catalina/servlets/DefaultServlet.java en... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-264: Permissions, Privileges, and Access Controls CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 89%CPEs: 107EXPL: 0CVE-2014-0075 – Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
https://notcve.org/view.php?id=CVE-2014-0075
29 May 2014 — Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data. Desbordamiento de enteros en la función parseChunkHeader en java/org/apache/coyote/http11/filters/ChunkedInputFilter.java en Apache Tomcat anterior a 6.... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-189: Numeric Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.8EPSS: 75%CPEs: 107EXPL: 0CVE-2014-0099 – Tomcat/JBossWeb: Request smuggling via malicious content length header
https://notcve.org/view.php?id=CVE-2014-0099
29 May 2014 — Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. Desbordamiento de enteros en java/org/apache/tomcat/util/buf/Ascii.java en Apache Tomcat anterior a 6.0.40, 7.x anterior a 7.0.53 y 8.x anterior a 8.0.4, cuando se opera detrás de un proxy inverso, permite a atacantes remotos real... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-189: Numeric Errors CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 4.3EPSS: 0%CPEs: 193EXPL: 0CVE-2013-4590 – tomcat: information disclosure via XXE when running untrusted web applications
https://notcve.org/view.php?id=CVE-2013-4590
26 Feb 2014 — Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Apache Tomcat anterior a 6.0.39, 7.x anterior a 7.0.50 y 8.x anterior a 8.0.0-RC10 permite a atacantes obtener información "... • http://advisories.mageia.org/MGASA-2014-0148.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 82%CPEs: 191EXPL: 0CVE-2013-4322 – tomcat: incomplete fix for CVE-2012-3544
https://notcve.org/view.php?id=CVE-2013-4322
26 Feb 2014 — Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. Apache Tomcat anterior a 6.0.39, 7.x anterior a 7.0.50 y 8.x anterior a 8.0.0-RC10 procesa codificació... • http://advisories.mageia.org/MGASA-2014-0148.html • CWE-20: Improper Input Validation •