Behoben in
Version prüfen
catalina.sh versionCVEs, die 7.0 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2025-24813 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | 10.0 | KEV | 99.9% | 2025-03-11 |
| CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache To... | 9.8 | KEV | 99.3% | 2020-02-25 |
| CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.... | 9.8 | KEV | 90.3% | 2017-04-07 |
| CVE-2017-12617 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.8... | 8.1 | KEV | 100.0% | 2017-10-04 |
| CVE-2017-12615 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly in... | 8.1 | KEV | 99.7% | 2017-09-19 |
| CVE-2026-43512 | Apache Tomcat: Digest authenticator will authenticate any unknown user | 9.8 | — | 2026-05-13 | |
| CVE-2026-65905 | Apache Tomcat: Limited replay attack possible with DIGEST authentication | 9.8 | — | 2026-08-26 | |
| CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.... | 9.8 | — | 2018-05-17 | |
| CVE-2026-43515 | Apache Tomcat: Security constraints not correctly applied | 9.1 | — | 2026-05-13 | |
| CVE-2026-55276 | Apache Tomcat: Logged effective web.xml is incomplete | 9.1 | — | 2026-06-30 | |
| CVE-2026-59083 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | 9.1 | — | 2026-07-14 | |
| CVE-2026-59084 | Apache Tomcat: EncryptInterceptor requirements not clearly documented | 9.1 | — | 2026-07-14 | |
| CVE-2026-65182 | Apache Tomcat: Bypass longest prefix security constraint | 9.1 | — | 2026-08-26 | |
| CVE-2026-68525 | Apache Tomcat: Redirect after FORM auth may bypass method specific constraints | 9.1 | — | 2026-08-26 | |
| CVE-2017-5648 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.... | 9.1 | — | 2017-04-18 | |
| CVE-2016-5018 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.4... | 9.1 | — | 2017-08-11 | |
| CVE-2015-5351 | The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9... | 8.8 | — | 2016-02-25 | |
| CVE-2016-0714 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.3... | 8.8 | — | 2016-02-25 | |
| CVE-2026-66422 | Apache Tomcat: Servlet role references can bypass declarative role constraints | 8.1 | — | 2026-08-26 | |
| CVE-2026-68569 | Apache Tomcat: Principal lookup can fail open in some cases | 8.1 | — | 2026-08-26 | |
| CVE-2015-5346 | Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2,... | 8.1 | — | 2016-02-25 | |
| CVE-2016-5388 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 sect... | 8.1 | — | 2016-07-19 | |
| CVE-2019-0232 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.... | 8.1 | — | 2019-04-15 | |
| CVE-2014-0230 | Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where... | 7.8 | — | 2015-06-08 | |
| CVE-2016-1240 | The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u... | 7.8 | — | 2016-10-03 | |
| CVE-2016-9774 | The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu... | 7.8 | — | 2017-03-24 | |
| CVE-2016-9775 | The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~de... | 7.8 | — | 2017-03-24 | |
| CVE-2020-8022 | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges | 7.7 | — | 2020-06-29 | |
| CVE-2026-29146 | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default | 7.5 | — | 2026-04-10 | |
| CVE-2026-41284 | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | 7.5 | — | 2026-05-13 | |
| CVE-2026-43513 | Apache Tomcat: LockOutRealm treats user names as case-sensitive | 7.5 | — | 2026-05-13 | |
| CVE-2011-3190 | Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.... | 7.5 | — | 2011-09-01 | |
| CVE-2013-2185 | The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enter... | 7.5 | — | 2014-01-20 | |
| CVE-2014-0050 | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other... | 7.5 | — | 2014-03-29 | |
| CVE-2016-3092 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.7... | 7.5 | — | 2016-07-05 | |
| CVE-2017-5647 | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0... | 7.5 | — | 2017-04-18 | |
| CVE-2017-5664 | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error pa... | 7.5 | — | 2017-06-06 | |
| CVE-2016-6797 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0... | 7.5 | — | 2017-08-11 | |
| CVE-2016-8745 | A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.... | 7.5 | — | 2017-08-11 | |
| CVE-2016-6796 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36... | 7.5 | — | 2017-08-11 | |
| CVE-2017-12616 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constrain... | 7.5 | — | 2017-09-19 | |
| CVE-2018-8034 | The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default.... | 7.5 | — | 2018-08-02 | |
| CVE-2018-1336 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loo... | 7.5 | — | 2018-08-02 | |
| CVE-2019-17563 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 ther... | 7.5 | — | 2019-12-24 | |
| CVE-2020-13935 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9... | 7.5 | — | 2020-07-15 | |
| CVE-2026-42498 | Apache Tomcat: WebSocket authentication header exposure | 7.3 | — | 2026-05-13 | |
| CVE-2026-55957 | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | 7.3 | — | 2026-06-30 | |
| CVE-2016-6816 | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0... | 7.1 | — | 2017-03-21 | |
| CVE-2021-25329 | Incomplete fix for CVE-2020-9484 | 7.0 | — | 2021-03-01 | |
| CVE-2019-12418 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lif... | 7.0 | — | 2019-12-24 | |
| CVE-2020-9484 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0... | 7.0 | — | 2020-05-21 | |
| CVE-2026-73180 | Apache Tomcat: Authenticated WebSocket session survives end of HTTP session | 6.8 | — | 2026-08-26 | |
| CVE-2013-2067 | java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tom... | 6.8 | — | 2013-06-01 | |
| CVE-2013-4444 | Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving out... | 6.8 | — | 2014-09-12 | |
| CVE-2021-30640 | Auth weakness in JNDIRealm | 6.5 | — | 2021-07-12 | |
| CVE-2026-55955 | Apache Tomcat: EncryptInterceptor not protected against replay attacks | 6.5 | — | 2026-06-30 | |
| CVE-2026-55956 | Apache Tomcat: Security constraints for default servlet ignored method | 6.5 | — | 2026-06-30 | |
| CVE-2018-1305 | Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8... | 6.5 | — | 2018-02-24 | |
| CVE-2010-2227 | Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid T... | 6.4 | — | 2010-07-14 | |
| CVE-2014-0227 | java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7... | 6.4 | — | 2015-02-16 | |
| CVE-2016-0763 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before... | 6.3 | — | 2016-02-25 | |
| CVE-2026-50229 | Apache Tomcat: XSS in number guess example | 6.1 | — | 2026-06-30 | |
| CVE-2019-0221 | The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes use... | 6.1 | — | 2019-05-29 | |
| CVE-2021-24122 | Apache Tomcat information disclosure | 5.9 | — | 2021-01-14 | |
| CVE-2016-0762 | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36,... | 5.9 | — | 2017-08-11 | |
| CVE-2018-1304 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in A... | 5.9 | — | 2018-03-01 | |
| CVE-2019-2684 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported vers... | 5.9 | — | 2019-04-24 | |
| CVE-2011-1088 | Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to... | 5.8 | — | 2011-03-15 | |
| CVE-2011-1419 | Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity ann... | 5.8 | — | 2011-03-15 | |
| CVE-2011-1183 | Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which all... | 5.8 | — | 2011-04-09 | |
| CVE-2013-4286 | Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connec... | 5.8 | — | 2014-02-26 | |
| CVE-2015-5345 | The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before... | 5.3 | — | 2016-02-25 | |
| CVE-2016-6794 | When a SecurityManager is configured, a web application's ability to read system properties should be controll... | 5.3 | — | 2017-08-11 | |
| CVE-2017-15706 | As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.... | 5.3 | — | 2018-01-31 | |
| CVE-2011-0534 | Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for re... | 5.0 | — | 2011-02-11 | |
| CVE-2011-1475 | The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which al... | 5.0 | — | 2011-04-09 | |
| CVE-2011-2729 | native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used... | 5.0 | — | 2011-08-16 | |
| CVE-2011-4858 | Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters... | 5.0 | — | 2012-01-06 | |
| CVE-2011-1184 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33,... | 5.0 | — | 2012-01-15 | |
| CVE-2011-5062 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33,... | 5.0 | — | 2012-01-15 | |
| CVE-2011-3375 | Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycl... | 5.0 | — | 2012-01-19 | |
| CVE-2012-0022 | Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for h... | 5.0 | — | 2012-01-19 | |
| CVE-2012-2733 | java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x befor... | 5.0 | — | 2012-11-17 | |
| CVE-2012-5885 | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomc... | 5.0 | — | 2012-11-18 | |
| CVE-2012-5886 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36,... | 5.0 | — | 2012-11-18 | |
| CVE-2012-5887 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36,... | 5.0 | — | 2012-11-18 | |
| CVE-2012-5568 | Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial H... | 5.0 | — | 2012-12-01 | |
| CVE-2012-3544 | Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked tra... | 5.0 | — | 2013-06-01 | |
| CVE-2014-0075 | Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.... | 5.0 | — | 2014-05-31 | |
| CVE-2014-7810 | The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x bef... | 5.0 | — | 2015-06-08 | |
| CVE-2019-17569 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a... | 4.8 | — | 2020-02-25 | |
| CVE-2020-1935 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an... | 4.8 | — | 2020-02-25 | |
| CVE-2011-2481 | Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applica... | 4.6 | — | 2011-08-16 | |
| CVE-2011-2526 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the... | 4.4 | — | 2011-07-15 | |
| CVE-2011-3376 | org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly rest... | 4.4 | — | 2011-11-12 | |
| CVE-2010-4172 | Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through... | 4.3 | — | 2010-11-27 | |
| CVE-2011-0013 | Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before... | 4.3 | — | 2011-02-19 | |
| CVE-2011-1582 | Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraint... | 4.3 | — | 2011-05-21 | |
| CVE-2011-5063 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33,... | 4.3 | — | 2012-01-15 | |
| CVE-2011-5064 | DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before... | 4.3 | — | 2012-01-15 | |
| CVE-2012-3546 | org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM a... | 4.3 | — | 2012-12-19 | |
| CVE-2012-4431 | org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32... | 4.3 | — | 2012-12-19 | |
| CVE-2013-4322 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding wi... | 4.3 | — | 2014-02-26 | |
| CVE-2013-4590 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat i... | 4.3 | — | 2014-02-26 | |
| CVE-2014-0096 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0099 | Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0119 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loa... | 4.3 | — | 2014-05-31 | |
| CVE-2015-5174 | Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, a... | 4.3 | — | 2016-02-25 | |
| CVE-2016-0706 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place... | 4.3 | — | 2016-02-25 | |
| CVE-2017-7674 | The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0... | 4.3 | — | 2017-08-11 | |
| CVE-2018-11784 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 re... | 4.3 | — | 2018-10-04 | |
| CVE-2026-43514 | Apache Tomcat: AJP secret compared in non-constant time | 3.7 | — | 2026-05-13 | |
| CVE-2012-4534 | org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the... | 2.6 | — | 2012-12-19 | |
| CVE-2013-2071 | java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handl... | 2.6 | — | 2013-06-01 | |
| CVE-2013-0346 | Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local... | 2.1 | — | 2014-02-15 | |
| CVE-2011-2204 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is us... | 1.9 | — | 2011-06-30 | |
| CVE-2010-3718 | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the... | 1.2 | — | 2011-02-11 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).