Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1Apache Struts Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 99.40%Sep 15, 2017
- Medium4.3The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the r…Check if you run itEPSS 8.04%Aug 11, 2017
- Medium5.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.Check if you run itEPSS 7.15%Aug 10, 2017
- Critical9.8Apache Struts 1 Improper Input Validation VulnerabilityPatch nowKEVEPSS 98.91%Jul 10, 2017
- High7.5The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the origina…Check this weekEPSS 16.57%Jun 6, 2017
- Critical9.8Adobe ColdFusion Deserialization VulnerabilityPatch nowKEVEPSS 90.60%Apr 27, 2017
- Critical9.1While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, an…Check this weekEPSS 13.23%Apr 17, 2017
- Critical9.8Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 90.34%Apr 6, 2017
- Critical9.8Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Mar 10, 2017
- High8.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications fr…Check this weekEPSS 50.90%Jul 19, 2016
- High8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site sc…Check this weekEPSS 25.74%Jul 4, 2016
- High8.1ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary…Check this weekEPSS 13.12%Jul 4, 2016
- Critical9.8Apache Shiro Code Execution VulnerabilityPatch nowKEVEPSS 93.04%Jun 7, 2016
- Critical9.8Apache ActiveMQ Improper Input Validation VulnerabilityPatch nowKEVEPSS 98.52%Jun 1, 2016
- High8.1Apache Struts Command Injection VulnerabilityPatch nowKEVEPSS 96.05%Apr 26, 2016
- Medium6.3The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does n…Check this weekEPSS 11.30%Feb 25, 2016
- High8.8The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes,…Check this weekEPSS 13.08%Feb 25, 2016
- Medium4.3Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the o…Check if you run itEPSS 6.23%Feb 25, 2016
- High8.8The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF token…Check if you run itEPSS 9.67%Feb 25, 2016
- High8.1Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments…Check this weekEPSS 10.57%Feb 25, 2016
- Medium5.3The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security…Check this weekEPSS 18.38%Feb 25, 2016
- Medium4.3Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to…Check this weekEPSS 12.55%Feb 25, 2016
- UnknownRed Hat data_grid Deserialization of Untrusted DataPatch nowKEVEPSS 85.56%Jan 28, 2016
- Critical9.8IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.Patch nowKEVEPSS 97.76%Jan 2, 2016
- Critical9.8Oracle WebLogic Server Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 94.99%Nov 18, 2015