Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: Apache Tomcat — USN-4251-1 Clear all filters
TI-2019-09263 CVE-2019-12418 · GHSA-hh3j-x4mc-g48r

Insufficiently protected credentials in Apache Tomcat

Priority LOW 35

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manip…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.01221 Published 2019-12-23 Partial fix · 7.0.99, 8.5.49 +1 CWE-522
TI-2019-13106 CVE-2019-17563 · GHSA-9xcj-c8cr-8c3c

Session fixation in Apache Tomcat

Priority MEDIUM 48

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.10687 Published 2019-12-23 Partial fix · 7.0.99, 8.5.50 +1 CWE-384