CVSS: 7.8EPSS: 7%CPEs: 114EXPL: 0CVE-2014-0230 – tomcat: non-persistent DoS attack by feeding data by aborting an upload
https://notcve.org/view.php?id=CVE-2014-0230
17 Sep 2014 — Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts. Apache Tomcat 6.x en versiones anteriores a 6.0.44, 7.x en versiones anteriores a 7.0.55 y 8.x en versiones anteriores a 8.0.9 no maneja adecuadamente los casos en los que se produce una respuesta HTTP... • http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 109EXPL: 0CVE-2014-0119 – Tomcat/JBossWeb: XML parser hijack by malicious web application
https://notcve.org/view.php?id=CVE-2014-0119
30 May 2014 — Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web applica... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-264: Permissions, Privileges, and Access Controls CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 4.3EPSS: 0%CPEs: 107EXPL: 0CVE-2014-0096 – Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
https://notcve.org/view.php?id=CVE-2014-0096
30 May 2014 — java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. java/org/apache/catalina/servlets/DefaultServlet.java en... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-264: Permissions, Privileges, and Access Controls CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 6%CPEs: 107EXPL: 0CVE-2014-0075 – Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
https://notcve.org/view.php?id=CVE-2014-0075
29 May 2014 — Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data. Desbordamiento de enteros en la función parseChunkHeader en java/org/apache/coyote/http11/filters/ChunkedInputFilter.java en Apache Tomcat anterior a 6.... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-189: Numeric Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.8EPSS: 0%CPEs: 107EXPL: 0CVE-2014-0099 – Tomcat/JBossWeb: Request smuggling via malicious content length header
https://notcve.org/view.php?id=CVE-2014-0099
29 May 2014 — Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. Desbordamiento de enteros en java/org/apache/tomcat/util/buf/Ascii.java en Apache Tomcat anterior a 6.0.40, 7.x anterior a 7.0.53 y 8.x anterior a 8.0.4, cuando se opera detrás de un proxy inverso, permite a atacantes remotos real... • http://advisories.mageia.org/MGASA-2014-0268.html • CWE-189: Numeric Errors CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 4.3EPSS: 0%CPEs: 193EXPL: 0CVE-2013-4590 – tomcat: information disclosure via XXE when running untrusted web applications
https://notcve.org/view.php?id=CVE-2013-4590
26 Feb 2014 — Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Apache Tomcat anterior a 6.0.39, 7.x anterior a 7.0.50 y 8.x anterior a 8.0.0-RC10 permite a atacantes obtener información "... • http://advisories.mageia.org/MGASA-2014-0148.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 86%CPEs: 191EXPL: 0CVE-2013-4322 – tomcat: incomplete fix for CVE-2012-3544
https://notcve.org/view.php?id=CVE-2013-4322
26 Feb 2014 — Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. Apache Tomcat anterior a 6.0.39, 7.x anterior a 7.0.50 y 8.x anterior a 8.0.0-RC10 procesa codificació... • http://advisories.mageia.org/MGASA-2014-0148.html • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 183EXPL: 0CVE-2013-4286 – tomcat: multiple content-length header poisoning flaws
https://notcve.org/view.php?id=CVE-2013-4286
25 Feb 2014 — Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. A... • http://advisories.mageia.org/MGASA-2014-0148.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 42%CPEs: 74EXPL: 4CVE-2014-0050 – Apache Commons FileUpload and Apache Tomcat - Denial of Service
https://notcve.org/view.php?id=CVE-2014-0050
07 Feb 2014 — MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. MultipartStream.java en Apache Commons FileUpload anterior a 1.3.1, utilizado en Apache Tomcat, JBoss Web y otros productos, permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU... • https://packetstorm.news/files/id/180508 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2012-5568
https://notcve.org/view.php?id=CVE-2012-5568
30 Nov 2012 — Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris. Apache Tomcat hasta v7.0.x permite a atacantes remotos provocar una denegación de servicio (parada del demonio) a través de peticiones HTTP parciales, tal y como quedó demostrado por Slowloris. • http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat •