https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:05:00 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-01759 bdu:2019-01759 https://cve.radiocsirt.org/vuln/bdu:2019-01759 https://cve.radiocsirt.org/vuln/cnvd-2018-03661 cnvd-2018-03661 https://cve.radiocsirt.org/vuln/cnvd-2018-03661 https://cve.radiocsirt.org/vuln/euvd-2026-180227 EUVD-2026-180227 https://cve.radiocsirt.org/vuln/euvd-2026-180227 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1304 <p>The URL pattern of &#34;&#34; (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.</p> <p>The URL pattern of &#34;&#34; (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-1304 https://cve.radiocsirt.org/vuln/ghsa-6rxj-58jh-436r <p><strong>Affected:</strong> Maven: org.apache.tomcat.embed:tomcat-embed-core</p> <p>The URL pattern of &#34;&#34; (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.</p> <p><strong>Affected:</strong> Maven: org.apache.tomcat.embed:tomcat-embed-core</p> <p>The URL pattern of &#34;&#34; (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.</p> https://cve.radiocsirt.org/vuln/ghsa-6rxj-58jh-436r https://cve.radiocsirt.org/vuln/gsd-2018-1304 gsd-2018-1304 https://cve.radiocsirt.org/vuln/gsd-2018-1304 https://cve.radiocsirt.org/vuln/rhsa-2018:0465 <p>apr: Out-of-bounds array deref in apr_time_exp*() functions tomcat: Remote Code Execution via JSP Upload tomcat: Information Disclosure when using VirtualDirContext tomcat: Remote Code Execution bypass for CVE-2017-12615 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users</p> <p>apr: Out-of-bounds array deref in apr_time_exp*() functions tomcat: Remote Code Execution via JSP Upload tomcat: Information Disclosure when using VirtualDirContext tomcat: Remote Code Execution bypass for CVE-2017-12615 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users</p> https://cve.radiocsirt.org/vuln/rhsa-2018:0465 https://cve.radiocsirt.org/vuln/rhsa-2019:2205 <p>tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users tomcat: Insecure defaults in CORS filter enable &#39;supportsCredentials&#39; for all origins tomcat: Host name verification missing in WebSocket client</p> <p>tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users tomcat: Insecure defaults in CORS filter enable &#39;supportsCredentials&#39; for all origins tomcat: Host name verification missing in WebSocket client</p> https://cve.radiocsirt.org/vuln/rhsa-2019:2205 https://cve.radiocsirt.org/vuln/suse-su-2018:0817-1 <p>Security update for tomcat</p> <p>Security update for tomcat</p> https://cve.radiocsirt.org/vuln/suse-su-2018:0817-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1304 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7</p> <p>The URL pattern of &#34;&#34; (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7</p> <p>The URL pattern of &#34;&#34; (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1304 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0528 <p>Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0528