CVE-2012-5886 Description The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5886 http://tools.cisco.com/security/center/viewAlert.x?alertId=27343 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3439 Project Category n/a Tags functional Date Disclosed 2012-11-17 Date Discovered 2012-11-17 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-5885 Description The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue or investigating other forms of authentication. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5885 http://tools.cisco.com/security/center/viewAlert.x?alertId=27343 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3439 Project Category n/a Tags functional…
Read More
CVE-2012-5633 Description The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. If upgrading is not an option this vulnerability can be mitigated by removing URIMappingInterceptor from use or by utilizing WS-SecurityPolicy. Ref: http://cxf.apache.org/cve-2012-5633.html Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5633 http://cxf.apache.org/cve-2012-5633.html Project Category n/a Tags data configuration functional Date Disclosed 2013-03-12 Date Discovered 2012-10-24 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us…
Read More
CVE-2012-5575 Description Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack." Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5575 https://cxf.apache.org/cve-2012-5575.html https://bugzilla.redhat.com/show_bug.cgi?id=880443 Project Category n/a Tags data functional Date Disclosed 2013-08-19 Date Discovered 2012-10-24 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us…
Read More
CVE-2012-4534 Description org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4534 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html https://bz.apache.org/bugzilla/show_bug.cgi?id=52858 Project Category n/a Tags data operational configuration Date Disclosed 2012-12-19 Date Discovered 2012-08-21 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-4431 Description org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4431 https://rhn.redhat.com/errata/RHSA-2013-0268.html Project Category n/a Tags data functional Date Disclosed 2012-12-19 Date Discovered 2012-08-21 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-3546 Description org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3546 https://mail-archives.apache.org/mod_mbox/tomcat-announce/201212.mbox/%3C50BE5367.6090809@apache.org%3E Project Category n/a Tags operational functional Date Disclosed 2012-12-19 Date Discovered 2012-06-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-3544 Description Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3544 https://bugs.mageia.org/show_bug.cgi?id=10201 Project Category n/a Tags functional Date Disclosed 2013-06-01 Date Discovered 2012-06-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-3451 Description Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3451 http://cxf.apache.org/cve-2012-3451.html Project Category n/a Tags data Date Disclosed 2012-09-24 Date Discovered 2012-06-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
CVE-2012-2733 Description java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data. Mitigation We recommend upgrading to a version of this component that is not vulnerable to this specific issue. Related links: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2733 http://mail-archives.apache.org/mod_mbox/www-announce/201211.mbox/%3C5098445A.3020407@apache.org%3E https://bugs.mageia.org/show_bug.cgi?id=8692 Project Category n/a Tags data operational Date Disclosed 2012-11-16 Date Discovered 2012-05-14 JTVCYnJhbmNoX2xpc3QlNUQlNUIlMkZicmFuY2hfbGlzdCU1RA== Feel Vulnerable? Contact us so we can help you.
Read More
