Skip to main content
May 23
Love0

CVE-2012-5575

By
CVE-2012-5575 Description Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack." Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5575 https://cxf.apache.org/cve-2012-5575.html https://bugzilla.redhat.com/show_bug.cgi?id=880443 Project Category n/a Tags data functional Date Disclosed 2013-08-19 Date Discovered 2012-10-24 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us…
Read More
May 23
Love0

CVE-2012-4431

By
CVE-2012-4431 Description org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4431 https://rhn.redhat.com/errata/RHSA-2013-0268.html Project Category n/a Tags data functional Date Disclosed 2012-12-19 Date Discovered 2012-08-21 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2012-3546

By
CVE-2012-3546 Description org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3546 https://mail-archives.apache.org/mod_mbox/tomcat-announce/201212.mbox/%3C50BE5367.6090809@apache.org%3E Project Category n/a Tags operational functional Date Disclosed 2012-12-19 Date Discovered 2012-06-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2012-3544

By
CVE-2012-3544 Description Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3544 https://bugs.mageia.org/show_bug.cgi?id=10201 Project Category n/a Tags functional Date Disclosed 2013-06-01 Date Discovered 2012-06-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2012-2379

By
CVE-2012-2379 Description Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Note: If this component is included as a bundled/transitive dependency of another component, there may not be an upgrade path. In this instance, we recommend contacting the maintainers who included the vulnerable package. Alternatively, we recommend investigating…
Read More
May 23
Love0

CVE-2012-0881

By
CVE-2012-0881 Description Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0881 https://issues.apache.org/jira/browse/XERCESJ-1685 Project Category n/a Tags data functional Date Disclosed 2017-10-30 Date Discovered 2012-01-19 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2011-5064

By
CVE-2011-5064 Description DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5064 http://tomcat.apache.org/security-6.html Project Category n/a Tags data functional Date Disclosed 2012-01-14 Date Discovered 2012-01-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2011-5063

By
CVE-2011-5063 Description The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5063 Project Category n/a Tags data functional Date Disclosed 2012-01-14 Date Discovered 2012-01-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2011-5062

By
CVE-2011-5062 Description The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5062 https://access.redhat.com/security/cve/CVE-2011-5062 Project Category n/a Tags data functional Date Disclosed 2012-01-14 Date Discovered 2012-01-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More
May 23
Love0

CVE-2011-2526

By
CVE-2011-2526 Description Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2526 http://www.securityfocus.com/archive/1/archive/1/518889/100/0/threaded Project Category n/a Tags data functional other Date Disclosed 2011-07-14 Date Discovered 2011-06-15 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable?  Contact us so we can help you.
Read More