Skip to contentApache Software Foundation Tomcat vulnerabilities
- apache tomcatApache Tomcat: JsonErrorReportValve escapingCVE-2022-45143Fix available7.5 High
- apache tomcatApache Tomcat request smuggling via malformed content-lengthCVE-2022-42252Fix available7.5 High
- apache tomcat, debian linux +1 moreApache Tomcat: Information disclosureCVE-2021-43980Fix available3.7 Low
- apache tomcatXSS in examples web applicationCVE-2022-34305Fix available6.1 Medium
- apache tomcat, debian linux, oracle hospitality cruise shipboard property management system +2 moreEncryptInterceptor does not provide complete protection on insecure networksCVE-2022-29885Public exploitFix availableEPSS 73.5%7.5 High
- apache tomcat, debian linux, oracle agile engineering data management +4 more +6 moreLocal privilege escalation with FileStoreCVE-2022-23181Fix available7.0 High
- apache tomcat, debian linux, netapp hci +15 more +17 moreDoS via memory leak with WebSocket connectionsCVE-2021-42340Fix availableEPSS 11.8%7.5 High
- apache tomcat, debian linux, netapp management services for element software and netapp hci +2 moreApache Tomcat DoS with unexpected TLS packetCVE-2021-41079Fix available7.5 High
- apache tomcat, tomee, debian linux +19 more +21 moreIncorrect Transfer-Encoding handling with HTTP/1.0CVE-2021-33037Fix availableEPSS 74.7%5.3 Medium
- apache tomcat, debian linux, oracle communications cloud native core policy +4 more +6 moreAuth weakness in JNDIRealmCVE-2021-30640Fix available6.5 Medium
- apache tomcat, mcafee epolicy orchestrator, oracle big data spatial and graph +2 moreDoS after non-blocking IO errorCVE-2021-30639Fix available7.5 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreIncomplete fix for CVE-2020-9484CVE-2021-25329Fix available7.0 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreApache Tomcat h2c request mix-upCVE-2021-25122Fix availableEPSS 18.1%7.5 High
- apache tomcat, debian linux, oracle agile product lifecycle management +2 moreApache Tomcat information disclosureCVE-2021-24122Fix availableEPSS 22.9%5.9 Medium
- apache tomcat, debian linux, netapp element plug-in +9 more +11 moreApache Tomcat: Request header mix-up between HTTP/2 streamsCVE-2020-17527Public exploitFix availableEPSS 24.6%7.5 High
- apache tomcat, oracle agile product lifecycle management +1 moreResponse mix-up with WebSocket concurrent send and closeCVE-2022-25762Fix available8.6 High
- apache tomcat, debian linux, oracle instantis enterprisetrack +1 more +3 moreExposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2020-13943Fix availableEPSS 52.6%4.3 Medium
- apache tomcat, canonical ubuntu linux, debian linux +15 more +17 moreInfinite Loop in Apache TomcatCVE-2020-13935Public exploitFix availableEPSS 86.6%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +11 more +13 moreImproper Restriction of Operations within the Bounds of a Memory Buffer in Apache TomcatCVE-2020-13934Fix availableEPSS 64.1%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +5 more +7 moreUncontrolled Resource Consumption in Apache TomcatCVE-2020-11996Public exploitFix availableEPSS 26.7%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +23 more +25 morePotential remote code execution in Apache TomcatCVE-2020-9484Public exploitFix availableEPSS 55.5%7.0 High
- apache tomcat, geode, blackberry good control +18 more +20 moreImproper Privilege Management in TomcatCVE-2020-1938In KEVPublic exploitFix availableEPSS 99.3%9.8 Critical
- apache tomcat, canonical ubuntu linux, debian linux +17 more +19 morePotential HTTP request smuggling in Apache TomcatCVE-2020-1935Fix available4.8 Medium
- apache tomcat, tomee, debian linux +13 more +15 morePotential HTTP request smuggling in Apache TomcatCVE-2019-17569Fix available4.8 Medium
- apache tomcat, canonical ubuntu linux, debian linux +3 more +5 moreInsufficiently Protected Credentials in Apache TomcatCVE-2019-12418Fix available7.0 High
- apache tomcat, canonical ubuntu linux, debian linux +8 more +10 moreIn Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attackCVE-2019-17563Fix availableEPSS 10.7%7.5 High
- apache tomcatImproper Locking in Apache TomcatCVE-2019-10072Fix availableEPSS 73.0%7.5 High
- apache tomcatCross-site scripting in Apache TomcatCVE-2019-0221Public exploitFix availableEPSS 58.3%6.1 Medium
- apache tomcatApache Tomcat Denial of Service vulnerabilityCVE-2019-0199Fix availableEPSS 72.9%7.5 High
- apache tomcat jk connector, apache software foundation tomcat connectors, debian linux +1 more +3 moreThe Apache Web Server (httpd) specific code that normalised the requested path before matching it...CVE-2018-11759Public exploitFix availableEPSS 90.6%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +12 more +14 moreApache Tomcat Open Redirect vulnerabilityCVE-2018-11784Public exploitFix availableEPSS 97.7%4.3 Medium
- apache tomcat, debian linux +1 moreApache Tomcat Race Condition vulnerabilityCVE-2018-8037Fix availableEPSS 11.2%5.9 Medium
- apache tomcat native, debian linux +1 moreApache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check...CVE-2018-8020Fix available7.4 High
- apache tomcat native, debian linux +1 moreWhen using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not...CVE-2018-8019Fix available7.4 High
- apache tomcat, canonical ubuntu linux, debian linux +1 more +3 moreThe host name verification missing in Apache TomcatCVE-2018-8034Fix availableEPSS 21.0%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +5 more +7 moreIn Apache Tomcat there is an improper handing of overflow in the UTF-8 decoderCVE-2018-1336Fix availableEPSS 20.4%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +5 more +7 moreThe defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all originsCVE-2018-8014Fix availableEPSS 20.9%9.8 Critical
- apache tomcat jk connector, apache software foundation tomcat connectors +1 moreThe IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that...CVE-2018-1323EPSS 46.8%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +7 more +9 moreApache Tomcat unauthorized access vulnerabilityCVE-2018-1304Public exploitFix availableEPSS 17.1%5.9 Medium
- apache tomcat, canonical ubuntu linux, debian linux +3 more +5 moreApache Tomcat information exposure vulnerabilityCVE-2018-1305Public exploitFix availableEPSS 14.5%6.5 Medium
- apache tomcat native, debian linux +1 moreWhen parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2...CVE-2017-15698Fix available5.9 Medium
- apache tomcatInconsistent documentation in Apache TomcatCVE-2017-15706Fix available5.3 Medium
- apache tomcat, canonical ubuntu linux, debian linux +55 more +57 moreUnrestricted Upload of File with Dangerous Type Apache TomcatCVE-2017-12617In KEVPublic exploitFix availableEPSS 100.0%8.1 High
- apache tomcat, netapp 7-mode transition tool, oncommand balance +19 more +21 moreWhen running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the serverCVE-2017-12615In KEVPublic exploitFix availableEPSS 99.7%8.1 High
- apache tomcatExposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2017-12616Fix availableEPSS 70.1%7.5 High
- apache tomcatImproper Limitation of a Pathname to a Restricted Directory in Apache TomcatCVE-2017-7675Fix availableEPSS 10.1%7.5 High
- apache tomcatImproper Restriction of Operations within the Bounds of a Memory Buffer in Apache TomcatCVE-2016-6817Fix available7.5 High
- apache tomcatInsufficient Verification of Data Authenticity in Apache TomcatCVE-2017-7674Fix available4.3 Medium
- apache tomcatImproper Handling of Exceptional Conditions in Apache TomcatCVE-2017-5664Fix availableEPSS 16.6%7.5 High
- apache tomcatExpected Behavior Violation in Apache TomcatCVE-2017-5651Fix available9.8 Critical
- Show moreLoading…