tomcat9-user vulnerabilities (TuxCare)
35 vulnerabilities.
-
tomcat9-userTuxCare Apache Tomcat: Principal lookup can fail open in some cases 8.1 High -
tomcat9-userTuxCare Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass 9.1 Critical -
tomcat9-userTuxCare Apache Tomcat: Security constraints for default servlet ignored method 6.5 Medium -
tomcat9-userTuxCare Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind 7.3 High -
tomcat9-userTuxCare Apache Tomcat: Security constraints not correctly applied 9.1 Critical -
tomcat9-userTuxCare Apache Tomcat: AJP secret compared in non-constant time 3.7 Low -
tomcat9-userTuxCare Apache Tomcat: LockOutRealm treats user names as case-sensitive 7.5 High -
tomcat9-userTuxCare Apache Tomcat: Digest authenticator will authenticate any unknown user 9.8 Critical -
tomcat9-userTuxCare Apache Tomcat: HTTP/2 request headers not validated 9.8 Critical -
tomcat9-userTuxCare Apache Tomcat: WebSocket authentication header exposure 7.3 High -
tomcat9-userTuxCare Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling 7.5 High -
tomcat9-userTuxCare Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 7.5 High -
tomcat9-userTuxCare Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default 7.5 High -
tomcat9-userTuxCare Apache Tomcat: Client certificate verification bypass due to virtual host mapping 9.1 Critical -
tomcat9-userTuxCare Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled 7.5 High -
tomcat9-userTuxCare Apache Tomcat: h2 DoS - Made You Reset 7.5 High -
tomcat9-userTuxCare Apache Tomcat: Bypass of rules in Rewrite Valve 9.8 Critical -
tomcat9-userTuxCare Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT 9.8 Critical -
tomcat9-userTuxCare Update of tomcat9 No score -
tomcat9-userTuxCare Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete 9.8 Critical -
tomcat9-userTuxCare Apache Tomcat: RCE due to TOCTOU issue in JSP compilation 9.8 Critical -
tomcat9-userTuxCare Apache Tomcat: Authentication bypass when using Jakarta Authentication API 9.8 Critical -
tomcat9-userTuxCare Apache Tomcat: Denial of Service 8.6 High -
tomcat9-userTuxCare Apache Tomcat: HTTP/2 excess header handling DoS 7.5 High -
tomcat9-userTuxCare Apache Tomcat: WebSocket DoS with incomplete closing handshake 6.3 Medium -
tomcat9-userTuxCare Apache Tomcat: HTTP/2 header handling DoS 7.5 High -
tomcat9-userTuxCare Apache Tomcat: HTTP request smuggling via malformed trailer headers 7.5 High -
tomcat9-userTuxCare Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests 5.3 Medium -
tomcat9-userTuxCare Apache Tomcat: Open redirect with FORM authentication 6.1 Medium -
tomcat9-userTuxCare Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations 7.5 High -
tomcat9-userTuxCare Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations 4.3 Medium -
tomcat9-userTuxCare Apache Tomcat request smuggling via malformed content-length 7.5 High -
tomcat9-userTuxCare EncryptInterceptor does not provide complete protection on insecure networks 7.5 High -
tomcat9-userTuxCare Local privilege escalation with FileStore 7.0 High -
tomcat9-userTuxCare Improper Privilege Management in Tomcat 9.8 Critical