https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:25:48 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:3645 <p><strong>Affected:</strong> AlmaLinux:9: tomcat, AlmaLinux:9: tomcat-admin-webapps, AlmaLinux:9: tomcat-docs-webapp, AlmaLinux:9: tomcat-el-3.0-api, AlmaLinux:9: tomcat-jsp-2.3-api, AlmaLinux:9: tomcat-lib, AlmaLinux:9: tomcat-servlet-4.0-api, AlmaLinux:9: tomcat-webapps</p> <p>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.</p> <p>Security Fix(es):</p> <p>* tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379) * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: tomcat, AlmaLinux:9: tomcat-admin-webapps, AlmaLinux:9: tomcat-docs-webapp, AlmaLinux:9: tomcat-el-3.0-api, AlmaLinux:9: tomcat-jsp-2.3-api, AlmaLinux:9: tomcat-lib, AlmaLinux:9: tomcat-servlet-4.0-api, AlmaLinux:9: tomcat-webapps</p> <p>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.</p> <p>Security Fix(es):</p> <p>* tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379) * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:3645 https://cve.radiocsirt.org/vuln/bdu:2025-02511 bdu:2025-02511 https://cve.radiocsirt.org/vuln/bdu:2025-02511 https://cve.radiocsirt.org/vuln/bit-tomcat-2025-24813 <p><strong>Affected:</strong> Bitnami: tomcat</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0 through 11.0.2, from 10.1.0 through 10.1.34, from 9.0.0 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> <p><strong>Affected:</strong> Bitnami: tomcat</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0 through 11.0.2, from 10.1.0 through 10.1.34, from 9.0.0 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/bit-tomcat-2025-24813 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0200 certfr-2025-avi-0200 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0200 https://cve.radiocsirt.org/vuln/cnvd-2025-04973 cnvd-2025-04973 https://cve.radiocsirt.org/vuln/cnvd-2025-04973 https://cve.radiocsirt.org/vuln/euvd-2026-257090 EUVD-2026-257090 https://cve.radiocsirt.org/vuln/euvd-2026-257090 https://cve.radiocsirt.org/vuln/fkie_cve-2025-24813 <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-24813 https://cve.radiocsirt.org/vuln/ghsa-83qj-6fr2-vhqg <p><strong>Affected:</strong> Maven: org.apache.tomcat:tomcat-catalina, Maven: org.apache.tomcat.embed:tomcat-embed-core</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> <p><strong>Affected:</strong> Maven: org.apache.tomcat:tomcat-catalina, Maven: org.apache.tomcat.embed:tomcat-embed-core</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.</p> <p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT</p> <p>If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack</p> <p>Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-83qj-6fr2-vhqg https://cve.radiocsirt.org/vuln/opensuse-su-2025:14896-1 <p>tomcat-9.0.99-1.1 on GA media</p> <p>tomcat-9.0.99-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14896-1 https://cve.radiocsirt.org/vuln/rhsa-2025:3454 <p>tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT</p> <p>tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT</p> https://cve.radiocsirt.org/vuln/rhsa-2025:3454 https://cve.radiocsirt.org/vuln/suse-su-2025:0954-1 <p>Security update for tomcat</p> <p>Security update for tomcat</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0954-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-24813 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:Pro:24.04:LTS: tomcat10, Ubuntu:Pro:24.04:LTS: tomcat9, Ubuntu:25.10: tomcat9</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:Pro:24.04:LTS: tomcat10, Ubuntu:Pro:24.04:LTS: tomcat9, Ubuntu:25.10: tomcat9</p> <p>Path Equivalence: &#39;file.Name&#39; (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat&#39;s file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-24813 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0511 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren oder Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren oder Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0511