Количество 1 533
Количество 1 533
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat 9. ...
CVE-2016-6797
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
CVE-2016-6797
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
CVE-2016-6797
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
CVE-2016-6797
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9. ...
CVE-2016-6794
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
CVE-2016-6794
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
CVE-2016-6794
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
CVE-2016-6794
When a SecurityManager is configured, a web application's ability to r ...
BDU:2026-14497
Уязвимость компонента EncryptInterceptor сервера приложений Apache Tomcat, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации
BDU:2026-06931
Уязвимость сервера приложений Apache Tomcat, связанная с недостатками процедуры аутентификации, позволяющая нарушителю повысить свои привилегии
BDU:2026-05103
Уязвимость сервера приложений Apache Tomcat, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить произвольный код
BDU:2026-05102
Уязвимость сервера приложений Apache Tomcat, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить произвольный код
BDU:2025-08953
Уязвимость сервера приложений Apache Tomcat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-08952
Уязвимость сервера приложений Apache Tomcat, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2024-11286
Уязвимость сервлета DefaultServlet сервера приложений Apache Tomcat, позволяющая нарушителю выполнить произвольный код
BDU:2024-10291
Уязвимость сервера приложений Apache Tomcat, связанная с непроверенным состоянием ошибки, позволяющая нарушителю обойти процесс аутентификации и вызвать отказ в обслуживании
BDU:2024-06407
Уязвимость компонента HTTP2 Stream Handler сервера приложений Apache Tomcat, позволяющая нарушителю вызвать отказ в обслуживании
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. | CVSS3: 5.7 | 22% Средний | больше 8 лет назад |
 | CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. | CVSS3: 9.8 | 22% Средний | больше 8 лет назад |
| CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9. ... | CVSS3: 9.8 | 22% Средний | больше 8 лет назад |
 | CVE-2016-6797 The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. | CVSS3: 7.5 | 8% Низкий | около 9 лет назад |
| CVE-2016-6797 The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. | CVSS3: 3.7 | 8% Низкий | почти 10 лет назад |
| CVE-2016-6797 The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. | CVSS3: 7.5 | 8% Низкий | около 9 лет назад |
| CVE-2016-6797 The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9. ... | CVSS3: 7.5 | 8% Низкий | около 9 лет назад |
| CVE-2016-6794 When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. | CVSS3: 5.3 | 7% Низкий | около 9 лет назад |
| CVE-2016-6794 When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. | CVSS3: 3.1 | 7% Низкий | почти 10 лет назад |
| CVE-2016-6794 When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. | CVSS3: 5.3 | 7% Низкий | около 9 лет назад |
| CVE-2016-6794 When a SecurityManager is configured, a web application's ability to r ... | CVSS3: 5.3 | 7% Низкий | около 9 лет назад |
 | BDU:2026-14497 Уязвимость компонента EncryptInterceptor сервера приложений Apache Tomcat, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации | CVSS3: 9.1 | 1% Низкий | 2 месяца назад |
| BDU:2026-06931 Уязвимость сервера приложений Apache Tomcat, связанная с недостатками процедуры аутентификации, позволяющая нарушителю повысить свои привилегии | CVSS3: 9.1 | 1% Низкий | 5 месяцев назад |
| BDU:2026-05103 Уязвимость сервера приложений Apache Tomcat, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.1 | 0% Низкий | 7 месяцев назад |
| BDU:2026-05102 Уязвимость сервера приложений Apache Tomcat, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить произвольный код | CVSS3: 6.5 | 0% Низкий | 7 месяцев назад |
| BDU:2025-08953 Уязвимость сервера приложений Apache Tomcat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 5.6 | 2% Низкий | около 1 года назад |
| BDU:2025-08952 Уязвимость сервера приложений Apache Tomcat, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 5.6 | 2% Низкий | около 1 года назад |
| BDU:2024-11286 Уязвимость сервлета DefaultServlet сервера приложений Apache Tomcat, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.8 | 44% Средний | больше 1 года назад |
| BDU:2024-10291 Уязвимость сервера приложений Apache Tomcat, связанная с непроверенным состоянием ошибки, позволяющая нарушителю обойти процесс аутентификации и вызвать отказ в обслуживании | CVSS3: 9.8 | 6% Низкий | почти 2 года назад |
| BDU:2024-06407 Уязвимость компонента HTTP2 Stream Handler сервера приложений Apache Tomcat, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 5% Низкий | около 2 лет назад |
Уязвимостей на страницу