Security News

주요 제품 취약점 (30건)

"Apache Tomcat" 관련 CVE만 표시 중 · 필터 해제 ×

Apache Tomcat infra
30건
KEV 8 · 최근 2026-08-04
기술CVE심각도유형KEV등재일
Apache Tomcat
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploade…
 CVE-2025-24813 9.8 CWE-44 KEV 2025-04-01
Apache Tomcat SysAid SysAid Server
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as…
 CVE-2023-47246 9.8 CWE-22 KEV 2023-11-13
Apache Tomcat
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M1…
 CVE-2016-8735 9.8 — KEV 2023-05-12
Apache Tomcat VMware Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit …
 CVE-2022-22965 9.8 CWE-94 KEV 2022-04-04
Apache Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as …
 CVE-2020-1938 9.8 — KEV 2022-03-03
Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via sett…
 CVE-2017-12617 8.1 CWE-434 KEV 2022-03-25
Apache Tomcat
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default t…
 CVE-2017-12615 8.1 CWE-434 KEV 2022-03-25
Apache Tomcat
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. …
 CVE-2026-34486 7.5 CWE-311 KEV 2026-08-04
Apache Tomcat
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affe…
 CVE-2026-86248 9.8 CWE-287 —
Apache Tomcat
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. …
 CVE-2026-76183 9.8 CWE-289 —
Apache Tomcat
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a clien…
 CVE-2026-65905 9.8 CWE-294 —
Apache Tomcat
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 …
 CVE-2026-65637 9.8 CWE-20 —
Apache Tomcat
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for C…
 CVE-2026-86350 9.1 CWE-444 —
Apache Tomcat
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user h…
 CVE-2026-68525 9.1 CWE-863 —
Apache Tomcat
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path…
 CVE-2026-65182 9.1 CWE-284 —
Apache Tomcat
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inje…
 CVE-2026-77762 8.1 CWE-362 —
Apache Tomcat
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated…
 CVE-2026-68569 8.1 CWE-287 —
Apache Tomcat
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm …
 CVE-2026-66422 8.1 CWE-285 —
Apache Tomcat
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user …
 CVE-2026-65183 8.1 CWE-367 —
Apache Tomcat
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is use…
 CVE-2026-87022 7.5 CWE-130 —
Apache Tomcat
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a r…
 CVE-2026-79677 7.5 CWE-772 —
Apache Tomcat
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing th…
 CVE-2026-78383 7.5 CWE-770 —
Apache Tomcat
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affect…
 CVE-2026-77791 7.5 CWE-400 —
Apache Tomcat
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This…
 CVE-2026-68763 7.5 CWE-400 —
Apache Tomcat
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule …
 CVE-2026-65927 7.5 CWE-193 —
Apache Tomcat
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 thro…
 CVE-2026-29146 7.5 CWE-209 —
Apache Tomcat
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user t…
 CVE-2026-78437 7.3 CWE-459 —
Apache Tomcat
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provi…
 CVE-2026-75973 7.3 CWE-287 —
Apache Tomcat
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certi…
 CVE-2026-73581 6.5 CWE-299 —
Apache Tomcat
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through…
 CVE-2026-66299 5.3 CWE-400 —