Denial of service in Apache Tomcat

Apache Tomcat - Security constraint bypass for pre/post-resources

Jakarta Tomcat Denial of Service vulnerability

Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

JULI logging component in Apache Tomcat does not restrict certain permissions for web applications

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

Exposure of Sensitive Information in Apache Tomcat

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

Apache Tomcat does not follow ServletSecurity annotations

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.

Apache Tomcat Path Traversal Vulnerability

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Apache Tomcat improperly escapes input from JsonErrorReportValve

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat