org.apache.tomcat/tomcat

Vulnerabilities (148)

• CVE-2013-4322Feb 26, 2014
  affected < 6.0.39fixed 6.0.39

  Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attacker

• CVE-2013-4286Feb 26, 2014
  affected < 6.0.39fixed 6.0.39

  Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length a

• CVE-2013-2185Jan 19, 2014
  affected < 7.0.39fixed 7.0.39

  The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instan

• CVE-2013-2071Jun 1, 2013
  affected >= 7.0.0, < 7.0.40fixed 7.0.40

  java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for

• CVE-2013-2067Jun 1, 2013
  affected >= 6.0.21, < 6.0.37fixed 6.0.37

  java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers

• CVE-2012-3544Jun 1, 2013
  affected >= 6.0.0, < 6.0.37fixed 6.0.37

  Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

• CVE-2012-4431Dec 19, 2012
  affected >= 6.0.0, < 6.0.36fixed 6.0.36

  org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

• CVE-2012-3546Dec 19, 2012
  affected >= 6.0.0, < 6.0.36fixed 6.0.36

  org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at t

• CVE-2012-5887Nov 17, 2012
  affected >= 5.5.0, < 5.5.36fixed 5.5.36

  The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to

• CVE-2012-5885Nov 17, 2012
  affected >= 5.5.0, < 5.5.36fixed 5.5.36

  The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) valu

• CVE-2012-0022Jan 19, 2012
  affected >= 5.5.0, < 5.5.35fixed 5.5.35

  Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a diffe

• CVE-2011-3375Jan 19, 2012
  affected >= 6.0.30, < 6.0.35fixed 6.0.35

  Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circum

• CVE-2011-5064Jan 14, 2012
  affected >= 5.5.0, < 5.5.34fixed 5.5.34

  DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cr

• CVE-2011-5063Jan 14, 2012
  affected >= 5.5.0, < 5.5.34fixed 5.5.34

  The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protectio

• CVE-2011-5062Jan 14, 2012
  affected >= 5.5.0, < 5.5.34fixed 5.5.34

  The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different

• CVE-2011-1184Jan 14, 2012
  affected >= 5.5.0, < 5.5.34fixed 5.5.34

  The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions

• CVE-2011-4858Jan 5, 2012
  affected >= 5.5.0, < 5.5.35fixed 5.5.35

  Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many craf

• CVE-2011-3190Aug 31, 2011
  affected >= 7.0.0, < 7.0.21fixed 7.0.21

  Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the conne

• CVE-2011-2481Aug 15, 2011
  affected >= 7.0.0, < 7.0.17fixed 7.0.17

  Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loade

• CVE-2011-2526Jul 14, 2011
  affected < 5.5.34fixed 5.5.34

  Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of se