Most recent entries from all

cnvd-2016-12570

EUVD-2026-201719

fkie_cve-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

GHSA-w3j5-q8f2-3cqq — Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

Affected: Maven: org.apache.tomcat:tomcat-util

gsd-2016-8745

openSUSE-SU-2024:11468-1 — tomcat-9.0.36-8.4 on GA media

tomcat-9.0.36-8.4 on GA media

RHSA-2017:0455 — Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update

tomcat: timing attack in Realm implementation tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation tomcat: Usage of vulnerable FileUpload package can result in denial of service tomcat: security manager bypass via IntrospectHelper utility function tomcat: tomcat writable config files allow privilege escalation tomcat: system property disclosure tomcat: security manager bypass via JSP Servlet config parameters tomcat: unrestricted access to global resources tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener tomcat: information disclosure due to incorrect Processor sharing

SUSE-SU-2017:1229-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2016-8745

Affected: Ubuntu:14.04:LTS: tomcat7, Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:16.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat8

WID-SEC-W-2022-1375 — JFrog Artifactory: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.