Read the docs
Red Hat Security Advisory

RHSA-2016:1087

Red Hat JBoss Web Server 3.0.3 update

Released 2016-05-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 6 records

TI-2016-00643 CVE-2016-0714 · GHSA-mv42-px54-87jw

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before…

Priority MEDIUM 55

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass in…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.13075 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.32 +2 CWE-264
TI-2015-04505 CVE-2015-5351 · GHSA-w7cg-5969-678w

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x…

Priority MEDIUM 50

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote att…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.09667 Published 2016-02-25 Partial fix · 7.0.68, 8.0.31 +1 CWE-352
TI-2015-04500 CVE-2015-5346 · GHSA-jrcp-c39h-r29x

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and…

Priority MEDIUM 48

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, mi…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.10573 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-79
TI-2015-04499 CVE-2015-5345 · GHSA-rh8q-vjgf-gf74

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before…

Priority MEDIUM 48

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attacker…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.1838 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.30 +2 CWE-22
TI-2016-00682 CVE-2016-0763 · GHSA-9hjv-9h75-xmpp

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in…

Priority MEDIUM 41

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalCont…

CVSS 3.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.11297 Published 2016-02-25 Partial fix · 7.0.68, 8.0.32 +1 CWE-264
TI-2016-00635 CVE-2016-0706 · GHSA-6vx3-hr43-cfrh

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before…

Priority LOW 29

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.06113 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-200