Apache » Tomcat : Security Vulnerabilities (Bypass)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2017-12616	200	Bypass +Info	2017-09-19	2018-06-28	5.0	None	Remote	Low	Not required	Partial	None	None
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
2	CVE-2017-7675	22	Dir. Trav. Bypass	2017-08-10	2018-06-15	5.0	None	Remote	Low	Not required	Partial	None	None
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
3	CVE-2016-6796	254	Bypass	2017-08-10	2018-06-05	5.0	None	Remote	Low	Not required	None	Partial	None
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
4	CVE-2016-6794	200	Bypass +Info	2017-08-10	2018-06-05	5.0	None	Remote	Low	Not required	Partial	None	None
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
5	CVE-2016-5018	254	Bypass	2017-08-10	2018-06-05	5.0	None	Remote	Low	Not required	None	Partial	None
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
6	CVE-2016-0763	264	DoS Bypass	2016-02-24	2018-06-01	6.5	None	Remote	Low	Single system	Partial	Partial	Partial
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
7	CVE-2016-0714	264	Exec Code Bypass	2016-02-24	2018-07-18	6.5	None	Remote	Low	Single system	Partial	Partial	Partial
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
8	CVE-2016-0706	200	Bypass +Info	2016-02-24	2018-07-18	4.0	None	Remote	Low	Single system	Partial	None	None
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
9	CVE-2015-5351	352	Bypass CSRF	2016-02-24	2018-07-18	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
10	CVE-2015-5174	22	Dir. Trav. Bypass	2016-02-24	2018-07-18	4.0	None	Remote	Low	Single system	Partial	None	None
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
11	CVE-2014-7810	284	Bypass	2015-06-07	2018-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
12	CVE-2014-0096	264	Bypass	2014-05-31	2018-10-09	4.3	None	Remote	Medium	Not required	Partial	None	None
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
13	CVE-2014-0050	264	DoS Bypass	2014-04-01	2018-10-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
14	CVE-2012-5887	287	Bypass	2012-11-17	2017-08-28	5.0	None	Remote	Low	Not required	None	Partial	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
15	CVE-2012-5886	287	Bypass	2012-11-17	2017-08-28	5.0	None	Remote	Low	Not required	None	Partial	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
16	CVE-2012-5885	264	Bypass	2012-11-17	2017-09-18	5.0	None	Remote	Low	Not required	Partial	None	None
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
17	CVE-2012-4431	264	Bypass CSRF	2012-12-19	2017-09-18	4.3	None	Remote	Medium	Not required	None	Partial	None
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
18	CVE-2012-3546	264	Bypass	2012-12-19	2017-09-18	4.3	None	Remote	Medium	Not required	None	Partial	None
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
19	CVE-2011-5064	310	Bypass	2012-01-14	2014-03-16	4.3	None	Remote	Medium	Not required	Partial	None	None
DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
20	CVE-2011-5063	287	Bypass	2012-01-14	2014-03-16	4.3	None	Remote	Medium	Not required	Partial	None	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
21	CVE-2011-5062	264	Bypass	2012-01-14	2014-03-16	5.0	None	Remote	Low	Not required	Partial	None	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
22	CVE-2011-3190	264	Bypass +Info	2011-08-31	2018-10-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
23	CVE-2011-2729	264	Bypass	2011-08-15	2018-10-09	5.0	None	Remote	Low	Not required	Partial	None	None
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
24	CVE-2011-2526	20	DoS Bypass	2011-07-14	2018-10-09	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
25	CVE-2011-1582	264	Bypass	2011-05-20	2018-10-09	4.3	None	Remote	Medium	Not required	None	Partial	None
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
26	CVE-2011-1419		Bypass	2011-03-14	2017-08-16	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
27	CVE-2011-1184	264	Bypass	2012-01-14	2017-09-18	5.0	None	Remote	Low	Not required	Partial	None	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
28	CVE-2011-1183		Bypass	2011-04-08	2018-10-09	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
29	CVE-2011-1088		Bypass	2011-03-14	2018-10-09	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
30	CVE-2009-2901	264	Bypass	2010-01-28	2018-10-10	4.3	None	Remote	Medium	Not required	Partial	None	None
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
31	CVE-2008-5515	22	Dir. Trav. Bypass	2009-06-16	2018-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
32	CVE-2008-3271	264	Bypass +Info	2008-10-13	2018-10-11	4.3	None	Remote	Medium	Not required	Partial	None	None
Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
33	CVE-2005-2090		XSS Bypass	2005-07-05	2018-10-19	4.3	None	Remote	Medium	Not required	None	Partial	None
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
34	CVE-2002-1394		Bypass	2003-01-17	2017-10-09	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
35	CVE-2002-0493	254	Bypass	2002-08-12	2016-10-24	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

Total number of vulnerabilities : 35 Page : 1 (This Page)