https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:09:47 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-04494 bdu:2022-04494 https://cve.radiocsirt.org/vuln/bdu:2022-04494 https://cve.radiocsirt.org/vuln/certfr-2017-avi-121 certfr-2017-avi-121 https://cve.radiocsirt.org/vuln/certfr-2017-avi-121 https://cve.radiocsirt.org/vuln/cnvd-2016-10420 cnvd-2016-10420 https://cve.radiocsirt.org/vuln/cnvd-2016-10420 https://cve.radiocsirt.org/vuln/euvd-2026-180330 EUVD-2026-180330 https://cve.radiocsirt.org/vuln/euvd-2026-180330 https://cve.radiocsirt.org/vuln/fkie_cve-2016-0762 <p>The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.</p> <p>The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2016-0762 https://cve.radiocsirt.org/vuln/ghsa-wxcp-f2c8-x6xv <p><strong>Affected:</strong> Maven: org.apache.tomcat:tomcat</p> <p>The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.</p> <p><strong>Affected:</strong> Maven: org.apache.tomcat:tomcat</p> <p>The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.</p> https://cve.radiocsirt.org/vuln/ghsa-wxcp-f2c8-x6xv https://cve.radiocsirt.org/vuln/gsd-2016-0762 gsd-2016-0762 https://cve.radiocsirt.org/vuln/gsd-2016-0762 https://cve.radiocsirt.org/vuln/rhsa-2017:0455 <p>tomcat: timing attack in Realm implementation tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation tomcat: Usage of vulnerable FileUpload package can result in denial of service tomcat: security manager bypass via IntrospectHelper utility function tomcat: tomcat writable config files allow privilege escalation tomcat: system property disclosure tomcat: security manager bypass via JSP Servlet config parameters tomcat: unrestricted access to global resources tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener tomcat: information disclosure due to incorrect Processor sharing</p> <p>tomcat: timing attack in Realm implementation tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation tomcat: Usage of vulnerable FileUpload package can result in denial of service tomcat: security manager bypass via IntrospectHelper utility function tomcat: tomcat writable config files allow privilege escalation tomcat: system property disclosure tomcat: security manager bypass via JSP Servlet config parameters tomcat: unrestricted access to global resources tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener tomcat: information disclosure due to incorrect Processor sharing</p> https://cve.radiocsirt.org/vuln/rhsa-2017:0455 https://cve.radiocsirt.org/vuln/rhsa-2017:2247 <p>tomcat: timing attack in Realm implementation tomcat: security manager bypass via IntrospectHelper utility function tomcat: system property disclosure tomcat: security manager bypass via JSP Servlet config parameters tomcat: unrestricted access to global resources</p> <p>tomcat: timing attack in Realm implementation tomcat: security manager bypass via IntrospectHelper utility function tomcat: system property disclosure tomcat: security manager bypass via JSP Servlet config parameters tomcat: unrestricted access to global resources</p> https://cve.radiocsirt.org/vuln/rhsa-2017:2247 https://cve.radiocsirt.org/vuln/suse-su-2016:3079-1 <p>Security update for tomcat</p> <p>Security update for tomcat</p> https://cve.radiocsirt.org/vuln/suse-su-2016:3079-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2016-0762 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: tomcat6, Ubuntu:16.04:LTS: tomcat6, Ubuntu:16.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat8</p> <p>The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: tomcat6, Ubuntu:16.04:LTS: tomcat6, Ubuntu:16.04:LTS: tomcat7, Ubuntu:16.04:LTS: tomcat8</p> <p>The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2016-0762