Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

16 records

Vendor: Oracle Component: Hospitality Cruise Shipboard Property Management System Clear all filters
TI-2022-12240 CVE-2022-29885 · GHSA-r84p-88g2-2vx2

EncryptInterceptor does not provide complete protection on insecure networks

Priority HIGH 77

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.73474 Published 2022-05-12 Partial fix · 10.1.0-M15, 10.0.21 +2 CWE-400
TI-2021-18769 CVE-2021-42340 · GHSA-wph7-x527-w3h5

DoS via memory leak with WebSocket connections

Priority MEDIUM 46

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11796 Published 2021-10-14 Partial fix · 10.1.0-M6, 10.0.12 +2 CWE-772
TI-2021-12641 CVE-2021-33037 · GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

Priority HIGH 69

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.74667 Published 2021-07-12 Partial fix · 10.0.7, 9.0.48 +1 CWE-444
TI-2021-11031 CVE-2021-30640 · GHSA-36qh-35cm-5w2w

Auth weakness in JNDIRealm

Priority MEDIUM 47

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.09886 Published 2021-07-12 Partial fix · 10.0.5, 9.0.45 +1 CWE-116
TI-2021-05104 CVE-2021-22112 · GHSA-gq28-h5vg-8prx

Improper privilege management in Spring Security

Priority MEDIUM 44

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03286 Published 2021-02-23 Fixed in 5.4.4, 5.3.8 +1 CWE-269
TI-2019-07539 CVE-2019-10219 · GHSA-m8p2-495h-ccmh

Cross-site scripting in hibernate-validator

Priority LOW 31

A vulnerability was found in Hibernate-Validator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02157 Published 2019-11-08 Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79