All CVEs — page 1099 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
A buffer over-read vulnerability in Apache Tomcat Native during TLS handshakes allows attackers to crash the JVM and cause a denial of service. This affects versions from 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15, where a malformed TLS packet can trigger an out-of-bounds memory read leading to a JVM crash.
This vulnerability allows an attacker to inject malicious XML data, potentially leading to unauthorized access or data manipulation in the Rule Tracking Compare Policies feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.
The flaw allows command injection in the Diagnose Settings feature, enabling an attacker to execute arbitrary commands on the server.
This vulnerability allows an attacker to bypass authentication in ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled, leading to unauthorized access and potential system compromise.
This vulnerability allows remote code execution in the Notification Profile module of ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below, enabling attackers to execute arbitrary code on the affected system.
Apache Tomcat's WebSocket implementation incorrectly handles length parameters when per-message-deflate compression is enabled, allowing attackers to smuggle WebSocket messages that bypass normal message boundaries and potentially manipulate message processing.
This flaw involves an inconsistent interpretation of HTTP/2 requests, leading to potential request header mix-ups, which can be exploited to manipulate HTTP requests and responses.
The flaw allows CLIENT_CERT authentication to fail improperly when soft fail is disabled, leading to potential unauthorized access.
This vulnerability allows a low-privilege user to escalate privileges to Administrator by importing a malicious Report Profile, posing a significant security risk.
Apache Tomcat suffers from a resource leak vulnerability where WebSocket connections are not properly released after their lifetime, leading to lost timeouts and eventual denial of service. This occurs when asynchronous WebSocket writes fail to release resources correctly.
Apache Tomcat suffers from a resource allocation flaw where unauthenticated AJP requests can pin processing threads, causing denial of service. This vulnerability allows attackers to exhaust available threads and make the server unavailable to legitimate users.
Apache Tomcat is vulnerable to a DoS attack through uncontrolled resource consumption during WebSocket close message processing, allowing attackers to exhaust system resources and make the service unavailable.
This flaw involves a race condition in Apache Tomcat that allows attackers to inject trailer fields into another HTTP/2 request, potentially leading to unauthorized actions or data manipulation.
This flaw allows authentication bypass for WebSocket endpoints, enabling unauthorized access. It matters because it can lead to full compromise of the application and system.