org.apache.tomcat:tomcat-catalina
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 10 advisory(ies)
Advisories (41)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-23hv-mwm6-g8jf Apache Tomcat Session Fixation vulnerability | 11.0.0-M1 – < 11.0.8 ; 10.1.0-M1 – < 10.1.42 ; 9.0.0.M1 – < 9.0.106 | Not affected |
| GHSA-27hp-xhwr-wr2m Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 11.0.0-M1 – < 11.0.2 ; 10.1.0-M1 – < 10.1.34 | Not affected |
| GHSA-2c9m-w27f-53rm Apache Tomcat vulnerable to Unprotected Transport of Credentials | 11.0.0-M1 – < 11.0.0-M3 ; 10.1.0-M1 – < 10.1.6 ; 9.0.0-M1 – < 9.0.72 ; … | Not affected |
| GHSA-344f-f5vg-2jfj Potential remote code execution in Apache Tomcat | 10.0.0-M1 – < 10.0.0-M5 ; 9.0.0 – < 9.0.35 ; 8.0.0 – < 8.5.55 ; … | Not affected |
| GHSA-3vx3-xf6q-r5xp Exposure of Resource to Wrong Sphere in Apache Tomcat | 9.0.0.M1 – < 9.0.0.M18 ; 8.5.0 – < 8.5.13 ; 8.0.0 – < 8.0.42 ; … | Not affected |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability | 11.0.0-M1 – < 11.0.8 ; 10.1.0 – < 10.1.42 ; 9.0.23 – < 9.0.106 | Not affected |
| GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 11.0.0-M1 – < 11.0.2 ; 10.1.0-M1 – < 10.1.34 ; 9.0.0.M1 – < 9.0.98 ; … | Not affected |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | 11.0.0-M1 – < 11.0.3 ; 10.1.0-M1 – < 10.1.35 ; 9.0.0.M1 – < 9.0.99 ; … | Not affected |
| GHSA-8qq4-8jvq-mfw4 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat | 7.0.0 – < 7.0.81 | Not affected |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability | 8.5.30 – < 9.0.116 ; 10.1.0-M1 – < 10.1.53 ; 11.0.0-M1 – < 11.0.20 | Not affected |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-9xrj-439h-62hg Improper Authentication in Apache Tomcat | 5.5.0 – < 5.5.36 ; 6.0.0 – < 6.0.36 ; 7.0.0 – < 7.0.30 | Not affected |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability | 11.0.0-M1 – < 11.0.25 ; 10.1.0-M1 – < 10.1.58 ; 9.0.0.M1 – < 9.0.121 ; … | Not affected |
| GHSA-cw54-59pw-4g8c Apache Tomcat Improper Access Control vulnerability | < 6.0.48 ; 7.0.0 – < 7.0.73 ; 8.0.0 – < 8.0.39 ; … | Affected |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability | 11.0.0-M1 – < 11.0.0-M11 ; 10.1.0-M1 – < 10.1.16 ; 9.0.0-M1 – < 9.0.83 ; … | Not affected |
| GHSA-ff77-26x5-69cr Apache Tomcat Rewrite rule bypass | 9.0.76 – < 9.0.104 ; 10.1.10 – < 10.1.40 ; 11.0.0-M2 – < 11.0.6 ; … | Not affected |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability | 11.0.0-M1 – < 11.0.0-M12 ; 10.1.0-M1 – < 10.1.14 ; 9.0.0-M1 – < 9.0.81 ; … | Not affected |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability | 11.0.0-M1 – < 11.0.25 ; 10.1.0-M1 – < 10.1.58 ; 9.0.0-M1 – < 9.0.121 ; … | Not affected |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-h2fw-rfh5-95r3 Apache Tomcat - CGI security constraint bypass | 9.0.0.M1 – < 9.0.105 ; 10.1.0-M1 – < 10.1.41 ; 11.0.0-M1 – < 11.0.7 ; … | Not affected |
| GHSA-h3gc-qfqq-6h8f Apache Tomcat - DoS in multipart upload | 11.0.0-M1 – < 11.0.8 ; 10.1.0-M1 – < 10.1.42 ; 9.0.0.M1 – < 9.0.106 ; … | Not affected |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability | 11.0.0-M1 – < 11.0.25 ; 10.1.0-M1 – < 10.1.58 ; 9.0.0-M1 – < 9.0.121 ; … | Not affected |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability | 10.1.0-M1 – < 10.1.5 ; 11.0.0-M2 – < 11.0.0-M5 ; 8.5.85 – < 8.5.88 ; … | Not affected |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release | 11.0.0-M1 – < 11.0.12 ; 10.1.0-M1 – < 10.1.47 ; 9.0.0.M1 – < 9.0.110 ; … | Not affected |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat | 9.0.0 – < 9.0.17 ; 8.5.0 – < 8.5.40 ; 7.0.0 – < 7.0.94 | Not affected |
| GHSA-prc3-7f44-w48j Missing XML Validation in Apache Tomcat | < 6.0.40 ; 7.0.0 – < 7.0.54 ; 8.0.0 – < 8.0.6 | Affected |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability | 10.1.0-M1 – < 10.1.13 ; 9.0.0-M1 – < 9.0.80 ; 8.5.0 – < 8.5.93 | Not affected |
| GHSA-qprx-q2r7-3rx6 Improper Input Validation in Apache Tomcat | < 6.0.40 ; 7.0.0 – < 7.0.54 ; 8.0.0 – < 8.0.6 | Affected |
| GHSA-rq2w-37h9-vg94 Apache Tomcat improperly escapes input from JsonErrorReportValve | 10.1.0 – < 10.1.2 | Not affected |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve | 9.0.40 – < 9.0.116 ; 10.1.0-M1 – < 10.1.54 ; 11.0.0-M1 – < 11.0.21 | Not affected |
| GHSA-v646-rx6w-r3qq Improper Access Control in Apache Tomcat | 7.0.0 – < 7.0.72 ; 8.0.0 – < 8.5.5 | Not affected |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences | 11.0.0-M1 – < 11.0.11 ; 10.1.0-M1 – < 10.1.45 ; 9.0.40 – < 9.0.109 ; … | Not affected |
| GHSA-wc4r-xq3c-5cf3 Apache Tomcat - Security constraint bypass for pre/post-resources | 11.0.0-M1 – < 11.0.8 ; 10.1.0-M1 – < 10.1.42 ; 9.0.0.M1 – < 9.0.106 ; … | Not affected |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal | 11.0.0-M1 – < 11.0.11 ; 10.1.0-M1 – < 10.1.45 ; 9.0.0-M11 – < 9.0.109 ; … | Not affected |
| GHSA-wr62-c79q-cv37 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits | 11.0.0-M1 – < 11.0.9 ; 10.1.0-M1 – < 10.1.43 ; 9.0.0.M1 – < 9.0.107 ; … | Not affected |
| GHSA-xcpr-7mr4-h4xq Apache Tomcat - Authentication Bypass | < 9.0.96 ; 10.1.0-M1 – < 10.1.30 ; 11.0.0-M1 – < 11.0.1 | Affected |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat | 9.0.0.M1 – < 9.0.1 ; 8.5.0 – < 8.5.23 ; 8.0.0-RC1 – < 8.0.47 ; … | Not affected |
Sources
| Source | Licence |
|---|