Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownApache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 6.71%Nov 9, 2023
- UnknownApache Tomcat Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 99.92%Apr 12, 2021
- High7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and…Check this weekEPSS 18.11%Mar 1, 2021
- High7.0When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents an…Check this weekEPSS 55.52%May 20, 2020
- Critical9.8Apache Tomcat Improper Privilege Management VulnerabilityPatch nowKEVEPSS 99.27%Feb 24, 2020
- Medium4.3When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.Check this weekEPSS 97.68%Oct 4, 2018
- Critical9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable '…Check this weekEPSS 21.31%May 16, 2018
- Medium5.9The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC…Check this weekEPSS 17.07%Feb 28, 2018
- Medium6.5Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied…Check this weekEPSS 14.47%Feb 23, 2018
- High8.1Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.97%Oct 3, 2017
- High7.5When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources serv…Check this weekEPSS 70.12%Sep 19, 2017
- High8.1Apache Tomcat on Windows Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.64%Sep 19, 2017
- Medium4.3The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the r…Check if you run itEPSS 8.04%Aug 11, 2017
- Medium5.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.Check if you run itEPSS 7.15%Aug 10, 2017
- High7.5The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the origina…Check this weekEPSS 16.57%Jun 6, 2017
- Critical9.1While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, an…Check this weekEPSS 13.23%Apr 17, 2017
- Critical9.8Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 90.34%Apr 6, 2017
- High8.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications fr…Check this weekEPSS 50.90%Jul 19, 2016
- Medium6.3The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does n…Check this weekEPSS 11.30%Feb 25, 2016
- High8.8The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes,…Check this weekEPSS 13.08%Feb 25, 2016
- Medium4.3Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the o…Check if you run itEPSS 6.23%Feb 25, 2016
- High8.8The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF token…Check if you run itEPSS 9.67%Feb 25, 2016
- High8.1Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments…Check this weekEPSS 10.57%Feb 25, 2016
- Medium5.3The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security…Check this weekEPSS 18.38%Feb 25, 2016
- Medium4.3Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to…Check this weekEPSS 12.55%Feb 25, 2016